Linux Security Cookbook

3.8. Restricting Access by Remote Hosts (xinetd)

Problem

You want only particular remote hosts to access a TCP service via xinetd .

Solution

Use xinetd.conf ’s only_from and no_access keywords:

service ftp
{
        only_from = 192.168.1.107
        ...
}

service smtp
{
        no_access = haxor.evil.org
        ...
}

Then reset xinetd so your changes take effect. [Recipe 3.3]

Discussion

This is perhaps the simplest way to specify access control per service. But of course it works only for services launched by xinetd.

only_from and no_access can appear multiple times in a service entry:

{
        no_access = haxor.evil.org           deny a particular host
        no_access += 128.220.                deny all hosts in a network
        ...
}

If a connecting host is found in both the only_from and no_access lists, xinetd takes one of the following actions:

• If the host matches entries in both lists, but one match is more specific than the other, the more specific match prevails. For example, 128.220.13.6 is more specific than 128.220.13.

• If the host matches equally specific entries in both lists, xinetd considers this a configuration error and will not start the requested service.

So in this example:

service whatever
{
        no_access = 128.220.     haxor.evil.org    client.example.com
        only_from = 128.220.10.  .evil.org         client.example.com
}

connections from 128.220.10.3 are allowed, but those from 128.220.11.2 are denied. Likewise, haxor.evil.org cannot connect, but any other hosts in evil.org can. client.example.com is incorrectly configured, so its connection requests will be refused. ...