Red Hat ENTERPRISE LINUX 5 - VIRTUAL SERVER ADMINISTRATION, Руководство по развертыванию

Страница: 682 / 848

Chapter 43. Securing Your Network
656
•
PARANOID
— Matches any host where the hostname does not match the host address.
Caution
The
KNOWN
,
UNKNOWN
, and
PARANOID
wildcards should be used with care, because they
rely on functioning DNS server for correct operation. Any disruption to name resolution
may prevent legitimate users from gaining access to a service.
43.5.2.1.2. Patterns
Patterns can be used in the client field of access rules to more precisely specify groups of client hosts.
The following is a list of common patterns for entries in the client field:
•
Hostname beginning with a period (.)
— Placing a period at the beginning of a hostname matches
all hosts sharing the listed components of the name. The following example applies to any host
within the
example.com
domain:
ALL : .example.com
•
IP address ending with a period (.)
— Placing a period at the end of an IP address matches all hosts
sharing the initial numeric groups of an IP address. The following example applies to any host within
the
192.168.x.x
network:
ALL : 192.168.
•
IP address/netmask pair
— Netmask expressions can also be used as a pattern to control access to
a particular group of IP addresses. The following example applies to any host with an address range
of
192.168.0.0
through
192.168.1.255
:
ALL : 192.168.0.0/255.255.254.0
Important
When working in the IPv4 address space, the address/prefix length (
prefixlen
) pair
declarations (CIDR notation) are not supported. Only IPv6 rules can use this format.
•
[IPv6 address]/prefixlen pair
— [net]/prefixlen pairs can also be used as a pattern to control access
to a particular group of IPv6 addresses. The following example would apply to any host with an
address range of
3ffe:505:2:1::
through
3ffe:505:2:1:ffff:ffff:ffff:ffff
:
ALL : [3ffe:505:2:1::]/64
•
The asterisk (*)
— Asterisks can be used to match entire groups of hostnames or IP addresses, as
long as they are not mixed in a client list containing other types of patterns. The following example
would apply to any host within the
example.com
domain: