Xinetd 簡介
一. 概論:
傳統 Linux 上簡易的安全機制藉由 tcp_wrapper 加以建構而成,這其中的要角即是由 inetd 扮演; inetd 可對存取主機的網路連線掌控規範,當外界有一個請求透由為 inetd 所管理的 por t時, inetd 會轉由 tcpd 的程式加以處理由其依 hosts.allow 及 hosts.deny 二個檔來就其請求的服務決定準許存取與否,再啟動相關的網路服務,如 telnet、ftp 等。
二. 特點:
RedHat 7.x 以 xinetd 取代 inetd ,主要著眼於其更為強大的存取控制功能,其主要特點如后:
1.強大的存取控制功能:
(1)內建針對惡意用戶端及善意用戶端差別待遇的存取管控設定
(2)藉由 libwrap 的支援,使其效能更甚於 tcpd
(3)xinetd 可限制連線進來的等級、從特定主機來的連線數目及一個網路服務的總次數
(4)對存取時間作特定的限制
(5)可將特定的網路服務設於特定的介面ip位址供內部網路之用
2.防阻 DoS 的攻擊
(1)藉由限制連線進來的等級以阻止「埠號炸彈」DoS 攻擊
(2)藉由限制特定主機來的同步連線數目,以防止其霸佔特定的網路服務
(3)藉由限制 log 檔的大小,以避免硬碟悉遭佔據
3.強大的 log 檔功能
(1)可為每一個網路服務獨立就 syslog 設定 logging 層級
(2)如不利用 syslog 功能,可為每一個網路服務建立一個單獨的 log 檔
(3)可記錄連線開始及結束的時間以決定用戶端存取服務的時間
(4)可記錄企圖連線而失敗的資訊
4.導向的功能
可在一台提供 NAT'd 功能的主機,執行 xinetd 的 redir 功能,將 TCP 資料流的網路服務導向另一主機
5.支援 IPv6
xinetd 自 xinetd 2.1.8.8pre* 起的版本支援 IPv6
6.與客戶端使用者的交談功能
當客戶端連線請求成功或失敗時xinetd會有標題警示使的客戶端能知悉連線狀態的改變
三. inetd 與 xinetd 檔案型態的比較
inetd 的設定檔一般悉將各個網路服務集中放在 inetd.conf 此一檔案中管理,新版的 inetd,inetd.conf 依舊保留但較為簡潔,而將各個網路服務以單一檔案的型態放在 /etc/inet.d 目錄下,作設定時則不在 inetd.conf 檔案中作設定,直接在 /etc/inet.d 目錄下作設定;此點與 RedHat 7.* 版本其設定檔為 /etc/xinetd.conf,且將各個網路服務以單一檔案的型態放在 /etc/xinetd.d 目錄下,甚為類似,然其檔案的表現型式則極為不同,茲表列如后:
(1)舊版 inetd.conf:
| # These are standard services. # ftp     stream  tcp     nowait  root    /usr/sbin/tcpd in.ftpd -l -a  telnet  stream  tcp     nowait  root    /usr/sbin/tcpd in.telnetd #gopher        stream  tcp nowait  root    /usr/sbin/tcpd        gn # do not uncomment smtp unless you *really* know what you are doing. # smtp is handled by the sendmail daemon now, not smtpd.  It does NOT # run from here, it is started at boot time from /etc/rc.d/rc#.d. #smtp        stream  tcp nowait  root    /usr/bin/smtpd        smtpd #nntp        stream        tcp        nowait        root        /usr/sbin/tcpd  in.nntpd # # # Pop and imap mail services et al # pop2    stream  tcp     nowait  root    /usr/sbin/tcpd ipop2d pop3    stream  tcp     nowait  root    /usr/sbin/tcpd ipop3d imap    stream  tcp     nowait  root    /usr/sbin/tcpd imapd # # Authentication # auth    stream  tcp     nowait  root    /usr/sbin/in.identd in.identd swat    stream  tcp     nowait.400 root    /usr/sbin/tcpd swat # # End of inetd.conf | 
 
(2)新版 inetd.conf:
 | # # inetd.conf        This file describes the services that will be available #              through the INETD TCP/IP super server.  To re-configure #              the running INETD process, edit this file, then send the #              INETD process a SIGHUP signal. # #              In order to comply with the Linux Standard Base #              specification, many services are now configured #              via individual files in the /etc/inet.d directory. # # # Builtin services (silently drop requests from ports < 512) # #echo        stream        tcp        nowait        root        internal #echo        dgram        udp  wait        root        internal #discard stream        tcp        nowait        root        internal #discard dgram        udp  wait        root        internal #daytime stream      tcp        nowait        root        internal #daytime dgram       udp        wait  root        internal #chargen stream      tcp        nowait        root        internal #chargen dgram       udp        wait  root        internal #time        stream        tcp        nowait        root        internal #time        dgram        udp  wait        root        internal # #        WARNING WARNING WARNING # #      When editing your inetd configuration manually, please #       edit the files in the /etc/inet.d subdirectory rather #       than inetd.conf. In particular, having entries for the #       same service both in inetd.conf and a file in /etc/inet.d #       is undefined. # | 
 
單一檔案的型態: 放置 /etc/inet.d 目錄下,例如 /etc/inet.d/wu-ftpd
ftp     stream  tcp     nowait  root    /usr/sbin/tcpd in.ftpd -l -a
(3) xinetd : 例如 
/etc/xinetd.conf
| # # Simple configuration file for xinetd # # Some defaults, and include /etc/xinetd.d/ defaults {         instances               = 60         log_type                = SYSLOG authpriv         log_on_success                = HOST PID         log_on_failure           = HOST } includedir /etc/xinetd.d | 
 
/etc/xinetd.d/wu-ftpd
| # default: on # description: The wu-ftpd FTP server serves FTP connections. It uses  #      normal, unencrypted usernames and passwords for authentication. service ftp {         socket_type            = stream         wait                  = no         user                  = root         server                       = /usr/sbin/in.ftpd         server_args               = -l -a         log_on_success                += DURATION USERID         log_on_failure           += USERID         nice                  = 10         disable                      = yes } | 
 
四. xinetd 的安裝方式:
xinetd 由 cs.colorado.edu.的 panos 所撰寫,各位可至: <ahref="http://www.xinetd.org/"> http://www.xinetd.org/  下載之。最新版本為 xinetd-2.3.0.tar.gz ,具體安裝方式如后:
tar zxvf xinetd-2.3.0.tar.gz
cd xinetd-2.3.0
./configure –prefix=/etc –with-libwrap –with-loadavg –with-inet6
make
make install
xinetd/xconv.pl < /etc/inetd.conf > /tmp/xinetd.conf  (可將 inetd.conf 轉換成 xinetd.conf 的語法)
註: --with-libwrap :可使 xinetd 支援 tcp wrappers
   –with-loadavg :可使 xinetd 支援 max_load,在系統超過負載時可停止服務
   --with-inet6 : 可使 xinetd 支援 IPv6,例如 127.0.0.1 可對應成 ::ffff:127.0.0.1 IPv6 的型態
cp xinetd/sample.conf /etc/xinetd.conf
cp /etc/sbin/xinetd /usr/sbin
cp /etc/man/man5/* /usr/man/man5/ (RedHat)
cp /etc/man/man5/* /usr/share/man/en/man5/ (Caldera)
cp /etc/man/man8/* /usr/man/man8/ (RedHat)
cp /etc/man/man8/* /usr/share/man/en/man8/ (Caldera)
五.xinetd 啟動及停止方式
1. (1)啟動:在系統提示符號下 xinetd
(2)停止 : ps –aux | grep xinetd
         kill –9 PID
2.在/etc/rc.d/init.d 目錄下編輯一 xinetd 檔(注意 function 檔放置路徑之不同),同時建立以下各檔
touch /var/run/xinetd.pid
touch /var/lock/subsys/xinetd
chmod 755 /etc/rc.d/init.d/xinetd
啟動 : /etc/rc.d/init.d/xinetd start
停止 : /etc/rc.d/init.d/xinetd stop
/etc/rc.d/init.d/xinetd 檔的內容如后:
| #!/bin/bash # # xinetd        This starts and stops xinetd. # # chkconfig: 345 56 50 # description: xinetd is a powerful replacement for inetd.  #                                 xinetd has access control machanisms, extensive  #              logging capabilities, the ability to make services  #              available based on time, and can place  #              limits on the number of servers that can be started,  #              among other things. # # processname: /usr/sbin/xinetd # config: /etc/sysconfig/network # config: /etc/xinetd.conf # pidfile: /var/run/xinetd.pid prog="xinetd" PATH=/sbin:/bin:/usr/bin:/usr/sbin # Source function library. . /etc/rc.d/init.d/functions # Get config. test -f /etc/sysconfig/network && . /etc/sysconfig/network # Check that networking is up. [ ${NETWORKING} = "yes" ] || exit 0 [ -f /usr/sbin/xinetd ] || exit 1 [ -f /etc/xinetd.conf ] || exit 1 RETVAL=0 start(){     echo -n $"Starting $prog: "     # Need to get rid of localization for external services -      # it doesn't make much sense to have i18n on the server side here     LANG=en_US     LC_TIME=en_US     LC_ALL=en_US     LC_MESSAGES=en_US     LC_NUMERIC=en_US     LC_MONETARY=en_US     LC_COLLATE=en_US     export LANG LC_TIME LC_ALL LC_MESSAGES LC_NUMERIC LC_MONETARY LC_COLLATE     unset HOME MAIL USER USERNAME     daemon xinetd -stayalive -reuse -pidfile /var/run/xinetd.pid     RETVAL=$?     echo     touch /var/lock/subsys/xinetd     return $RETVAL } stop(){     echo -n $"Stopping $prog: "     killproc xinetd     RETVAL=$?     echo     rm -f /var/lock/subsys/xinetd     return $RETVAL } reload(){     echo -n $"Reloading configuration: "      killproc xinetd -USR2     RETVAL=$?     echo     return $RETVAL } restart(){     stop     start } condrestart(){     [ -e /var/lock/subsys/xinetd ] && restart     return 0 } # See how we were called. case "$1" in     start)                             start                             ;;     stop)                             stop                             ;;     status)                             status xinetd                             ;;     restart)                             restart                             ;;     reload)                             reload                             ;;     condrestart)                             condrestart                             ;;     *)                             echo $"Usage: $0 {start|stop|status|restart|condrestart|reload}"                             RETVAL=1 esac exit $RETVAL |