Xinetd(extended Internet
Daemon) is a secure replacement forinetd(the
Internet services daemon).It is a computer Program that monitors incoming
packets to determine if the external device is autorized to have access. inetd launches the required programs for
Internet connectivity at the time of system initialization.
These programs lie dormant until the connection is made. Once the request is
made , inetd launches the required program or server (FTP,Telnet,SSH etc) to answer the request. Where Xinetd is a program that listen on all the
ports for Internet services like Telnet,FTP & POP3. When it
recognizes a packet is coming through a particular port , xinetd launched the
appropriate program or server to handle the connection
Xinetd provides access control for all services based on the address of
the remote host and/or on time of access and can prevent denial-of-access
attacks. Xinetd provides extensive
logging, has no limit on the number of server arguments, and lets you bind
specific services to specific IP addresses on your host machine. Each service
has its own specific configuration file for Xinetd, the files are located
at the /etc/xinetd.ddirectory.
Advantages of xinetd :
1.
It conserve the system resources by avoiding to fork a lot of
process which might be dormant(inactive) for most of their life time.
2.
Xinetd is not limited to the services listed in /etc/services but
any body can use xined to start special purpose service.
Some Xinetd features that enable a
more secure way of managingInternet services :
1.
TCP Wrapper ACLs - TCP wrappper ACLs(Access Control List) monitor and filter
incoming request for the SYSTAT, FINGER, FTP, TELNET,
RLOGIN, RSH, EXEC, TFTP, TALK & other network services.
2.
Access Control – This feature enables xinetd to restrict or allow connections
based on the address of the remote host, time of access,duration of connection,
name of the remote host, domain of the remote host, Xinetd also limit the rate
of incoming connections from the particular host using TCP Wrapper.
3.
Controls Denial of Service
Attacks - Apart from limiting the number of simultaneous
connections from the same host , xinted executes limits placed on the log files
created by the host to prevent filling up disk space.
4.
Superior
Note: - We are assuming that
xinetd is package is installed on a linux box
The configuration files for xinetd are as follows:
The configuration files for xinetd are as follows:
·
/etc/xinetd.conf — The global xinetd configuration file.
·
/etc/xinetd.d/ — The directory containing all service-specific files.
The /etc/xinetd.conf file contains general configuration settings
which effect every service under xinetd's control. It is read once when the
xinetd service is started, so for configuration changes to take effect, the
administrator must restart the xinetd service.
Below is a sample /etc/xinetd.conf file:
defaults
{
instances = 60
log_type = SYSLOG authpriv
log_on_success = HOST PID
log_on_failure = HOST
cps = 25 30
}
includedir /etc/xinetd.d
{
instances = 60
log_type = SYSLOG authpriv
log_on_success = HOST PID
log_on_failure = HOST
cps = 25 30
}
includedir /etc/xinetd.d
These lines control the
following aspects of xinetd:
·
instances — Sets the maximum number of requests xinetd can handle at once.
·
log_type — Configures xinetd to use the authpriv log facility, which writes
log entries to the /var/log/secure file. Adding a directive such as FILE
/var/log/xinetdlog would create a custom log file called xinetdlog in the
/var/log/ directory.
·
log_on_success — Configures xinetd to
log if the connection is successful. By default, the remote host's IP address
and the process ID of server processing the request are recorded.
·
log_on_failure — Configures xinetd to log if there is a connection failure or if
the connection is not allowed.
·
cps — Configures xinetd to
allow no more than 25 connections per second to any given service. If this
limit is reached, the service is retired for 30 seconds.
·
includedir /etc/xinetd.d/ — Includes options declared in the service-specific configuration
files located in the /etc/xinetd.d/ directory
Configuring Telnet Service
Using Xinetd :
Sample file of telnet
is located at /etc/xinetd.d/telnet
service telnet
{
disable = no
flags = REUSE
socket_type = stream
wait = no
user = root
server = /usr/sbin/in.telnetd
log_on_failure += USERID
no_access = 10.0.1.0/24
log_on_success += PID HOST EXIT
access_times = 09:45-16:15
}
{
disable = no
flags = REUSE
socket_type = stream
wait = no
user = root
server = /usr/sbin/in.telnetd
log_on_failure += USERID
no_access = 10.0.1.0/24
log_on_success += PID HOST EXIT
access_times = 09:45-16:15
}
·
service — Defines the service name, usually one listed in the
/etc/services file.
·
flags — Sets any of a number
of attributes for the connection. REUSE instructs xinetd to reuse the socket
for a Telnet connection.
·
socket_type — Sets the network socket type to stream.
·
wait — Defines whether the
service is single-threaded (yes) or multi-threaded (no).
·
user — Defines what user ID
the process runs under.
·
server — Defines the binary
executable to be launched.
·
log_on_failure — Defines logging parameters for log_on_failure in addition to
those already defined in xinetd.conf.
·
disable — Defines whether the service is active.
. only_from — Allows only the specified hosts to use the
service.
·
no_access — Blocks listed hosts from using the service.
·
access_times — Specifies the time range when a particular service may be used.
The time range must be stated in 24-hour format notation, HH:MM-HH:MM.
The only_from andno_access options
can use a list of IP addresses or host names, or can specify an entire network.
Like TCP wrappers, combining xinetd access control with the enhanced logging
configuration can increase security by blocking requests from banned hosts
while verbosely recording each connection attempt. For example, the
following /etc/xinetd.d/telnet file can be used to block Telnet
access from a particular network group and restrict the overall time range that
even allowed users can log in , as shown in above example.
In this example, when a
client system from the 10.0.1.0/24 network, such as 10.0.1.2, tries to access
the Telnet service, it receives a message stating the following message:
Connection closed by
foreign host.
In addition, their
login attempts are logged in /var/log/secure
