This chapter is from the book
This chapter is from the book
This chapter is from the book
Exercise 2: xinetd
Description
xinetd is a replacement for the inetd daemon. It addresses many of the shortcomings of inetd. It can perform access control based on the time of the access and on the remote hostname, address, or domain. It kills services that are no longer in its configuration file or that no longer meet the access criteria. It can help prevent denial of service attacks by limiting access to many of the resources that are targeted by those attacks. It provides extensive logging capabilities for successful or unsuccessful connections. It also allows services to be bound to specific IP addresses. Another interesting capability of xinetd is that its features can be extended to chrooted environments (special, highly secured areas in a Unix system that are often used to publish vulnerable services, such as bind/DNS, FTP, sendmail, or Web access).
While it is not compatible with existing inetd.conf configuration files, a utility is provided that can convert an inetd.conf file to the xinetd format.
The configuration settings for xinetd are stored in /etc/xnetd.conf. There are as many sections as there are services, plus a section for default settings. However, in the xinetd.conf provided by the standard Red Hat installation, there is a single default section and an include statement that includes the files in the /etc/xinet.d directory.
The format of a section is
serviceservice_name { attribute operator value(s) ... }
xinetd provides three services of its own—servers, services, and xadmin. Since these services provide information about your host, they represent a security vulnerability and should be enabled only when configuring xinetd.
Objective
The objective of this exercise is to familiarize you with the configuration of xinetd to control access to your system.
Requirements
Permission
If you are not the legal owner of the systems used for this exercise, you
should obtain authorization from the legal owner and/or your management team
prior to conducting this exercise. Do not proceed without receiving
the necessary permissions.
Hardware
Intel-based PC
Software
Red Hat Linux 7.2
Challenge Procedure
The following are the steps that you will perform for this exercise:
Establish a default deny policy.
Allow Telnet access for internal access only.
Configure FTP for internal access only.
Allow access to xadmin.
Disable access to xadmin through the default settings.
Challenge Procedure Step-by-Step
The following are the detailed steps you will perform for this exercise:
-
Establish a default deny policy. To do this, log in as root. Then, open a Telnet session to the local host:
-
Log in to the system. At a command prompt, type in exit to close the Telnet session. Change the directory to /etc:
-
Edit the xinetd.conf:
-
Position the cursor on the line that begins with cps. Press the o key to add a new line. Add the following entry to deny all access by default:
-
Press the Esc key to exit insert mode. Press ZZ to save the changes and exit vi. Enter the following command to activate the new policy:
-
Try to open a Telnet session again:
-
Next, allow Telnet access for internal access only. Change the directory to /etc/xinetd.d:
-
Edit the Telnet configuration file:
-
Position the cursor on the line that begins with disable. Press the o key to add a new line.
-
Press the Esc key to exit insert mode. Press ZZ to save the changes and exit vi. Enter the following command to activate the new policy:
-
Try to open a Telnet session again:
-
Edit the Telnet configuration file:
-
Position the cursor on the line that begins with access_times. Press dd to delete the entry.
Press ZZ to save the changes and exit vi. Enter the following command to activate the new policy:
-
Next, allow access to xadmin. Change the directory to /etc/xinetd.d:
Edit the Telnet configuration file:
Press the o key to add a new line.
Press the Esc key to exit insert mode. Press ZZ to save the changes and exit vi. Enter the following command to activate the new policy:
Try to open a Telnet session to xadmin:
Disable access to xadmin through the default settings. Change the directory to /etc:
-
Edit the xinetd.conf file:
-
Position the cursor on the line that begins with no_access. Press the o key to add a new line. Add the following entry to deny access to xadmin:
Press the Esc key to exit insert mode. Press ZZ to save the changes and exit vi. Enter the following command to activate the new policy:
Try to open a Telnet session to xadmin:
telnet 127.0.0.1
){kind=link}
cd /etc
){kind=link}
vi xinetd.conf
no_access = 0.0.0.0/0
){kind=link}
/etc/init.d/xinetd reload
){kind=link}
telnet 127.0.0.1
){kind=link}
cd /etc/xinetd.d
vi telnet
){kind=link}
Add the following entry to grant access by the local network:
instances= 4
access_times = 7:00-12:30 13:30-21:00
only_from = 127.0.0.0/24
Your system is not on a network, thus, you should use the local loopback network. On a live system you should enter the IP network address and corresponding CIDR subnet mask, for example, 192.168.0.0/24.
){kind=link}
/etc/init.d/xinetd reload
){kind=link}
telnet 127.0.0.1
){kind=link}
Because of the time limitations, this test may or may not work depending on when you try it.
vi telnet
){kind=link}
/etc/init.d/xinetd reload
Try to open a Telnet session again:
telnet 127.0.0.1
cd /etc/xinetd.d
){kind=link}
vi xadmin
){kind=link}
Add the following entries to grant access by the local network:
service xadmin
{
type = INTERNAL UNLISTED
port = 9100
protocol = tcp
socket_type = stream
wait = no
instances = 1
only_from = 127.0.0.1
}
){kind=link}
/etc/init.d/xinetd reload
){kind=link}
telnet 127.0.0.1 9100
Then, enter the following command to see what services are available:
show avail
Finally, type exit to close the xadmin session.
){kind=link}
cd /etc
vi xinetd.conf
disable server services xadmin
){kind=link}
/etc/init.d/xinetd reload
){kind=link}
telnet 127.0.0.1 9100
){kind=link}
Additional Reading
"An Unofficial Xinetd Tutorial," curator of The Shmoo Group, http://www.macsecurity.org/resources/xinetd/tutorial.shtml.
Raynal, Frédéric. "Xinetd," LinuxFocus.org, http://www.linuxfocus.org/English/November2000/article175.html.
Summary
As a replacement for inetd, xinetd does everything that inetd does, but it does so more securely. The primary benefit of xinetd is that it is an efficient combination of inetd and TCP Wrappers.
In addition to providing client access control, xinetd also helps protect against denial of service attacks, bind services to a specific IP address, and control access by time period.