Red Hat ENTERPRISE LINUX 4 - SECURITY GUIDE Manual

Also see for ENTERPRISE LINUX 4 - DEVELOPER TOOLS GUIDE: Installation guide Installation guide Tuning guide Installation guide Manual

Contents

Enhancing Security With xinetd415.1.2. Enhancing Security With xinetdThe xinetd super server is another useful tool for controlling access to its subordinate services. Thissection focuses on how xinetd can be used to set a trap service and control the amount of resourcesany given xinetd service can use to thwart denial of service attacks. For a more thorough list of theoptions available, refer to the man pages for xinetd and xinetd.conf.5.1.2.1. Setting a TrapOne important feature of xinetd is its ability to add hosts to a global no_access list. Hosts on thislist are denied subsequent connections to services managed by xinetd for a specified length of timeor until xinetd is restarted. This is accomplished using the SENSOR attribute. This technique is aneasy way to block hosts attempting to port scan the server.The first step in setting up a SENSOR is to choose a service you do not plan on using. For thisexample, Telnet is used.Edit the file /etc/xinetd.d/telnet and change the flags line to read:flags = SENSORAdd the following line within the braces:deny_time = 30This denies the host that attempted to connect to the port for 30 minutes. Other acceptable values forthe deny_time attribute are FOREVER, which keeps the ban in effect until xinetd is restarted, andNEVER, which allows the connection and logs it.Finally, the last line should read:disable = noWhile using SENSOR is a good way to detect and stop connections from nefarious hosts, it has twodrawbacks:• It does not work against stealth scans.• An attacker who knows that a SENSOR is running can mount a denial of service attack againstparticular hosts by forging their IP addresses and connecting to the forbidden port.5.1.2.2. Controlling Server ResourcesAnother important feature of xinetd is its ability to control the amount of resources which servicesunder its control can utilize.It does this by way of the following directives:• cps = — Dictates the connections allowed tothe service per second. This directive accepts only integer values.