SELinux3
SELinux中
TCP_Wrapper
：
语法规则：
daemon_list: client_list [:opt1 :opt2...]
通过控制某些规则来限制用户的访问权限
定义允许规则：
/etc/hosts.allow
定义拒绝规则：
/etc/hosts.deny
IP address (192.168.0.1, 10.0.0 .)
name (www.redhat.com, .example.com)
netmask (192.168.0.0/255.255.255.0)
network name
例：【
1.
在
/etc/hosts.allow
和
/etc/hosts.deny
定义规则后，通常会先去匹配
/etc/hosts.allow
中的内容，如果匹配到了就不在去
/etc/hosts.deny
中匹配了；若不匹配再去
/etc/hosts.deny
中进行匹配
vim /etc/hosts.allow
（如果在这个用来定义允许的文件中只定义了
allow
项，则后边的
allow
就可以省略了，也可以在这既定义
ALLOW
又定义
DENY
的）
# hosts.allow This file describes the names of the hosts which are
# allowed to use the local INET services, as decided
# by the '/usr/sbin/tcpd' server.
#
in.telnetd:192.168.0.0/255.255.255.0 EXCEPT 192.168.0.106
（在
192.168.0.0
网段内除了
192.168.0.106
主机不允许进行访问外，其他的都被允许）
vim /etc/hosts.deny
（如果在这个用来定义允许的文件中只定义了
deny
项，则后边的
allow
就可以省略了，也可以在这既定义
ALLOW
又定义
DENY
的）
# hosts.deny This file describes the names of the hosts which are
# *not* allowed to use the local INET services, as decided
# by the '/usr/sbin/tcpd' server.
#
# The portmap line is redundant, but it is left to remind you that
# the new secure portmap uses hosts.deny and hosts.allow. In particular
# you should know that NFS uses portmap!
in.telnetd:ALL
service xinetd restart
（重启服务）
用
192.168.0.106
主机登录将被拒绝；
如果用
192.168.0.0
内除了
192.168.0.106
外的其他任意一台主机均可
telnet
远程登录如下：
# telnet 192.168.0.108
Trying 192.168.0.108...
Connected to server8.example.com (192.168.0.108).
Escape character is '^]'.
Welcome to come here!!!!!!
Connection closed by foreign host.
若将
/etc/hosts.allow
中的规则改为：
in.telnetd:ALL EXCEPT 192.168.0.0/255.255.255.0 EXCEPT 192.168.0.106
/etc/hosts.deny
中的规则不变，则
192.168.0.0
网段中只有
192.168.0.106
主机可以
telnet
远程登录了，除了
192.168.0.0
网段外，其他网段的所有主机也都能
telent
成功登录。
【
2.
如何发送邮件
：
vim /etc/hosts.allow
# hosts.allow This file describes the names of the hosts which are
# allowed to use the local INET services, as decided
# by the '/usr/sbin/tcpd' server.
#
in.telnetd:192.168.0.0/255.255.255.0:spawn /bin/echo `date` %c %d | bin/mail -s "Somebody has telnetd our server." root
vim /etc/hosts.deny
# hosts.deny This file describes the names of the hosts which are
# *not* allowed to use the local INET services, as decided
# by the '/usr/sbin/tcpd' server.
#
# The portmap line is redundant, but it is left to remind you that
# the new secure portmap uses hosts.deny and hosts.allow. In particular
# you should know that NFS uses portmap!
in.telnetd:ALL:spawn /bin/echo `date` %c %d | /bin/mail -s "Somebody has telnetd our server." root
service xinetd restart
（重启服务）
此时
192.168.0.
网段内的主机都能登录成功：
# telnet 192.168.0.108
Trying 192.168.0.108..
Connected to server8.example.com (192.168.0.108).
Escape character is '^]'.
Welcome to come here!!!!!!
Red Hat Enterprise Linux Server release 5.4 (Tikanga)
Kernel 2.6.18 -164.el5 on an i686
login: thg
Password:
Last login: Wed Feb 24 02:01:49 from server6
登录上后可以切换到
root
用户，来查看是否有邮件：
$ su -
Password:
# mail
Mail version 8.1 6/6/93 . Type ? for help.
"/var/spool/mail/root": 1 message 1 new
>N 1 [email protected] Wed Feb 24 03:12 16/733 "Somebody has telnetd "
& 1
Message 1:
From [email protected] Wed Feb 24 03:12:25 2010
Date: Wed, 24 Feb 2010 03:12:25 +0800
From: root <[email protected]>
Subject: Somebody has telnetd our server.
Wed Feb 24 03:12:25 CST 2010 192.168.0.106 in.telnetd
&
【
3.
在一个文件中编辑，如何来实现
ALLOW
和
DENY
的访问控制
：
(1)vim /etc/hosts.allow
# hosts.allow This file describes the names of the hosts which are
# allowed to use the local INET services, as decided
# by the '/usr/sbin/tcpd' server.
#
in.telnetd:192.168.0.111:
spawn
/bin/echo `date` %c to %s is denied by %A > /var/log/tcpwrapper.log:DENY
in.telnet:192.168.0. 192.168.1. :ALLOW
service xinetd restart
（重启服务）
此时，
192.168.0.106
登录失败：
# telnet 192.168.0.108
Trying 192.168.0.108...
Connected to server8.example.com (192.168.0.108).
Escape character is '^]'.
Welcome to come here!!!!!!
Connection closed by foreign host.
(2)twist
的作用
:
他会把本来可以登录的结果被他终断，最终登录将会被拒绝。
vim /etc/hosts.allow
# hosts.allow This file describes the names of the hosts which are
# allowed to use the local INET services, as decided
# by the '/usr/sbin/tcpd' server.
in.telnetd:192.168.0.0/255.255.255.0:
twist
/bin/echo `date` connection refused by %s
service xinetd restart
（重启服务）
# telnet 192.168.0.108
Trying 192.168.0.108...
Connected to server8.example.com (192.168.0.108).
Escape character is '^]'.
Welcome to come here!!!!!!
Wed Feb 24 03:47:36 CST 2010 connection refused by [email protected]
Connection closed by foreign host.
（
1
）上面两个例子结合使用：
vim /etc/hosts.allow
# hosts.allow This file describes the names of the hosts which are
# allowed to use the local INET services, as decided
# by the '/usr/sbin/tcpd' server.
in.telnetd:192.168.0.111:
pawn
/bin/echo `date` %c to %s is denied.>> /var/log/tcpwrapper.log ;
twist
/bin/echo `date` Attemp log to %s failed.
in.telnetd:192.168.0. 192.168.1.:ALLOW
service xinetd restart
（重启服务）
此时，
192.168.0.106
登录失败：
# telnet 192.168.0.108
Trying 192.168.0.108...
Connected to server8.example.com (192.168.0.108).
Escape character is '^]'.
Welcome to come here!!!!!!
Connection closed by foreign host.