Red Hat ENTERPRISE LINUX 5 - VIRTUAL SERVER ADMINISTRATION, Руководство по развертыванию

Страница: 681 / 848

TCP Wrappers Configuration Files
655
•
<option>
— An optional action or colon-separated list of actions performed when the rule is
triggered. Option fields support expansions, launch shell commands, allow or deny access, and alter
logging behavior.
Note
More information on the specialist terms above can be found elsewhere in this Guide:
•
Section 43.5.2.1.1, “Wildcards”
•
Section 43.5.2.1.2, “Patterns”
•
Section 43.5.2.2.4, “Expansions”
•
Section 43.5.2.2, “Option Fields”
The following is a basic sample hosts access rule:
vsftpd : .example.com
This rule instructs TCP Wrappers to watch for connections to the FTP daemon (
vsftpd
) from any
host in the
example.com
domain. If this rule appears in
hosts.allow
, the connection is accepted. If
this rule appears in
hosts.deny
, the connection is rejected.
The next sample hosts access rule is more complex and uses two option fields:
sshd : .example.com \ : spawn /bin/echo `/bin/date` access denied>>/var/log/sshd.log \ : deny
Note that each option field is preceded by the backslash (\). Use of the backslash prevents failure of
the rule due to length.
This sample rule states that if a connection to the SSH daemon (
sshd
) is attempted from a host in the
example.com
domain, execute the
echo
command to append the attempt to a special log file, and
deny the connection. Because the optional
deny
directive is used, this line denies access even if it
appears in the
hosts.allow
file. Refer to
Section 43.5.2.2, “Option Fields”
for a more detailed look at
available options.
43.5.2.1.1. Wildcards
Wildcards allow TCP Wrappers to more easily match groups of daemons or hosts. They are used
most frequently in the client list field of access rules.
The following wildcards are available:
•
ALL
— Matches everything. It can be used for both the daemon list and the client list.
•
LOCAL
— Matches any host that does not contain a period (.), such as localhost.
•
KNOWN
— Matches any host where the hostname and host address are known or where the user is
known.
•
UNKNOWN
— Matches any host where the hostname or host address are unknown or where the user
is unknown.