Access Control Using Xinetd - Red Hat LINUX 7.2 Reference Manual

150

9.3 Access Control Using xinetd

The benefits offered by TCP wrappers are only multiplied when the libwrap.a library is used in
conjunction with xinetd, a super-daemon that provides additional access, logging, binding, redirec-
tion and resource utilization control.
Red Hat Linux configures a variety of popular network services to be used with xinetd, includ-
ing FTP, IMAP, POP, and telnet. When any of these services are accessed via their port numbers in
/etc/services, the xinetd daemon handles the request. Before bringing up the requested net-
work service by the correct user, xinetd ensures that the client host information meets the access
control rules, the number of instances of this service is under a particular threshold, and any other rules
specified for that service or all xinetd services are followed. Once the target service is brought up
for the connecting client, xinetd goes back to sleep, waiting for additional requests for the services
it manages.
9.3.1 xinetd Configuration Files
The xinet service is controlled by the /etc/xinetd.conf file, as well as the various service-
specific files in the /etc/xinetd.d directory.
/etc/xinetd.conf
The xinetd.conf file is the parent of all xinetd-controlled service configuration files, as the
service-specific files are also parsed every time xinetd starts. By default, xinetd.conf contains
some basic configuration settings that apply to every service:
defaults
{
instances
}
includedir /etc/xinetd.d
These lines control various aspects of how xinetd does its job:
• instances — Sets the maximum number of requests a particular service can handle at once.
• log_type — Tells xinetd to use the authpriv log, specified in /etc/syslog.conf
and set to /var/log/secure by default, rather than using another specific file. Using
FILE /var/log/xinetdlog here instead would move xinetd logging to a separate
/var/log/xinetdlog file.
log_type
log_on_success = HOST PID
log_on_failure = HOST
Chapter 9:TCP Wrappers and xinetd
= 60
= SYSLOG authpriv