Red Hat ENTERPRISE LINUX 3 Reference Manual page 263

Chapter 16. TCP Wrappers and
Note
In practice, this example does not work until the syslog daemon (
the facility. Refer to the
local0
facilities.
16.2.2.2. Access Control
Option fields also allow administrators to explicitly allow or deny hosts in a single rule by adding the
or directive as the final option.
allow deny
For instance, the following two rules allow SSH connections from
deny connections from
sshd : client-1.example.com : allow
sshd : client-2.example.com : deny
By allowing access control on a per-rule basis, the option field allows administrators to consolidate
all access rules into a single file: either
way of organizing access rules.
16.2.2.3. Shell Commands
Option fields allow access rules to launch shell commands through the following two directives:
— Launches a shell command as a child process. This option directive can perform tasks
• spawn
like using
/usr/sbin/safe_finger
special log files using the
In the following example, clients attempting to access Telnet services from the
main are quietly logged to a special file:
in.telnetd : .example.com \
: spawn /bin/echo '/bin/date' from %h>>/var/log/telnet.log \
: allow
— Replaces the requested service with the specified command. This directive is often used
• twist
to set up traps for intruders (also called "honey pots"). It can also be used to send messages to
connecting clients. The twist command must occur at the end of the rule line.
In the following example, clients attempting to access FTP services from the
are sent a message via the
vsftpd : .example.com \
: twist /bin/echo "421 Bad hacker, go away!"
For more information about shell command options, refer to the
16.2.2.4. Expansions
Expansions, when used in conjunction with the
about the client, server, and processes involved.
Below is a list of supported expansions:
— Supplies the client's IP address.
• %a
— Supplies the server's IP address.
• %A
xinetd
syslog.conf
client-2.example.com
hosts.allow
to get more information about the requesting client or create
command.
echo
command:
echo
man page for information about configuring custom log
:
or
hosts.deny
hosts_options
and
spawn twist
) is configured to log to
syslogd
client-1.example.com
. Some consider this an easier
example.com
example.com
man page.
directives provide information
245
, but
do-
domain