Silicon Graphics Gauntlet, Руководство администратора

Страница: 243 / 306

Using This Information
217
TELNET proxy reads the netperm-table file to determine how long a session must be idle
before it should disconnect the session.
You can also include rules to permit or deny a particular service for requests to specific
addresses or networks. For example, you can configure the HTTP proxy to deny requests
to a particular host or network. All of the other proxies, such as the smapd server, continue
to use the generic policy and send information to that site, while the HTTP proxy denies
requests to that site.
Because the proxies and applications read the netperm-table file from top to bottom, you
must put proxy-specific rules before the generic policies. When the relevant proxy parses
the configuration information, it uses the proxy-specific rule rather than the more general
policy rule.
For example, the FTP proxy includes a generic rule that denies requests to the destination
ftp.bigu.edu. The general outside policy, near the bottom of the netperm-table file includes
a rule that allows all proxies and applications to send to any destination. Because the
more restrictive rule is above the generic policy in the netperm-table file, the FTP proxy
uses the restrictive rule and denies requests to ftp.bigu.edu.
Applications
Other Gauntlet applications such as the authentication server also read configuration
information from the netperm-table file.
Using This Information
As part of the startup process a proxy or application reads the netperm-table file looking
for applicable configuration rules. It parses the table from top to bottom, looking for rules
that match its name. It also matches wildcard rules that apply to all applications. For
example, the TELNET proxy (tn-gw) looks for rules that match tn-gw and *.
The proxy first uses these rules to determine if it can accept the request from the source
address. It then determines whether the requested service is an explicitly permitted
service. If it is not, the proxy denies the request. If it can accept the request, it uses the
other rules to determine whether it needs to authenticate the request, and whether it can
send the request to the specified destination. The application also finds and uses rules for
that specific application.