Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Setting Restriction of Access to Linux

Posted on 2002-04-03
10
Medium Priority
?
464 Views
Last Modified: 2013-12-16
I'm thinking to restrict acess to Linux
eg. accessing via Telnet..
How could I set the Linux in order to restrict certains ports?
0
Comment
Question by:usher
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
10 Comments
 
LVL 4

Expert Comment

by:MFCRich
ID: 6917938
This would depend on what criteria you are going to use to decide what is allowed and what isn't.

If you want to restrict which machines can telnet to your Linux box, inetd/xinetd can be configured to handle this or you could use firewall rules.
0
 

Author Comment

by:usher
ID: 6921170
I could not find inetd, instead, I can find xinedt.d folder
which contains several files. One of which is telnet conf file. Is this the one I need to change in order to stop this service?
0
 
LVL 1

Accepted Solution

by:
MindBender earned 200 total points
ID: 6922585
usher, You might find this easy to do with only editing
the hosts.deny and hosts.allow files.
___________________________
Typically you should have your hosts.deny set as:
ALL: ALL

___________________________
Your hosts.allow you can add the ip of the machines that you want to allow to connect to your Linux box.

ALL: 192.168.1.24
___________________________

MindBender
0
Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

 

Expert Comment

by:narayanamoorthy
ID: 6941782
You can restrict assessing your machine by two ways.

1. As said by MindBender.  This is possible only if you are using TCP wrappers.

2. By filtering (using ipchains or iptables according to your kernel).

If the telnet conf file in ur xinetd.d contains a line like /usr/sbin/tcpd in.telnetd, then u had TCP wrappers installed and the method of MindBender is absolutely right to allocate telnet only to 192.168.1.24 machine.

If you don't had TCP wrappers, then ipchains/iptables can be used.

Suppose you want to permit only 192.168.1.24 to telnet into the server.

/sbin/ipchains -A input -s ! 192.168.1.24 --destination-port 21 -j DENY

or

/sbin/ipchains -t filter -A INPUT -s ! 192.168.1.24 -p tcp --destination-port 21 -j DENY
I think this will solve ur problem

Moorthy
0
 

Expert Comment

by:narayanamoorthy
ID: 6941838
You can restrict assessing your machine by two ways.

1. As said by MindBender.  This is possible only if you are using TCP wrappers.

2. By filtering (using ipchains or iptables according to your kernel).

If the telnet conf file in ur xinetd.d contains a line like /usr/sbin/tcpd in.telnetd, then u had TCP wrappers installed and the method of MindBender is absolutely right to allocate telnet only to 192.168.1.24 machine.

If you don't had TCP wrappers, then ipchains/iptables can be used.

Suppose you want to permit only 192.168.1.24 to telnet into the server.

/sbin/ipchains -A input -s ! 192.168.1.24 --destination-port 21 -j DENY

or

/sbin/ipchains -t filter -A INPUT -s ! 192.168.1.24 -p tcp --destination-port 21 -j DENY
I think this will solve ur problem

Moorthy
0
 
LVL 1

Expert Comment

by:toddrose
ID: 6954103
This is for RedHat using xinetd.

You can use the xinetd.d/telnet file to disable ANY telnet access.  This is mine, notice the "disable = yes" line.  This prevents ANY incoming access on port 23 from starting telnet.  This will NOT prevent you from running the telnet daemon and poosibly allowing access,  this also prevents you from using telnet on your "internal" network for administration (not realy a bad thing if you use ssh instead).

Of course, if you want to use telnet internaly you need to use ipchains or iptables to restrict access to port 23 to allow only internal traffic to reach port 23.


File: telnet            Col 0              303 bytes                        100%
# default: on
# description: The telnet server serves telnet sessions; it uses \
#       unencrypted username/password pairs for authentication.
service telnet
{
        disable = yes
        flags           = REUSE
        socket_type     = stream
        wait            = no
        user            = root
        server          = /usr/sbin/in.telnetd
        log_on_failure  += USERID
}


You can edit /etc/sysconfig/ipchains and add the following lines.

-A input -p tcp -s 192.168.10.0/24 -d 192.168.10.0/24 23:23 -y -j ACCEPT
-A input -p udp -s 192.168.10.0/24 -d 192.168.10.0/24 23:23 -j ACCEPT

These ALLOW access to port 23 ONLY when the source and destinations are inside my firewall (really the 192.168.10.x subnet).  You will need to enable the xinetd.d/telnet to use telnet.


Sinc you also asked about ports in general...
The first line DENY's tcp traffic from anywhere TO anywhere.  DENY means that a response is sent back to requestor (means someone now knows a machine is at your IP Address).  the REJECT line stops UDP traffic on ports 0 through 1023 and does NOT send any response, this means a port scanner will not "see" your system.  So for "stealth" type protection, set both to REJECT.

-A input -p tcp -s 0/0 -d 0/0 0:1023 -y -j DENY
-A input -p udp -s 0/0 -d 0/0 0:1023 -j REJECT

The ipchains man pages will give you a much better explanation of all the parameters.

FYI:
port 21 is for FTP.
I DO NOT enable Telnet and only use ssh.

Todd R.
0
 
LVL 3

Expert Comment

by:hnminh
ID: 6974651
Keep your life simple!!! TCP wrapper is xinetd in RedHat, telnet-server, wu-ftpd package is installed to work with xinetd. Follow MindBender instruction! Dont complicate a simple task by using ipchains/iptables, those are for real firewall config.
0
 

Expert Comment

by:CleanupPing
ID: 9077035
usher:
This old question needs to be finalized -- accept an answer, split points, or get a refund.  For information on your options, please click here-> http:/help/closing.jsp#1 
EXPERTS:
Post your closing recommendations!  No comment means you don't care.
0
 
LVL 1

Expert Comment

by:drewber
ID: 9220346
This question has been classified abandoned. I will make a recommendation to the moderators on its resolution in a week or two. I appreciate any comments that would help me to make a recommendation.
 

Unless it is clear to me that the question has been answered I will recommend delete. It is possible that a Grade less than A will be given if no expert makes a case for an A grade. It is assumed that any participant not responding to this request is no longer interested in its final disposition.

 
If the user does not know how to close the question, the options are here:
http://www.experts-exchange.com/help/closing.jsp
 
drewber
0

Featured Post

Learn how to optimize MySQL for your business need

With the increasing importance of apps & networks in both business & personal interconnections, perfor. has become one of the key metrics of successful communication. This ebook is a hands-on business-case-driven guide to understanding MySQL query parameter tuning & database perf

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

How many times have you wanted to quickly do the same thing to a list but found yourself typing it again and again? I first figured out a small time saver with the up arrow to recall the last command but that can only get you so far if you have a bi…
I. Introduction There's an interesting discussion going on now in an Experts Exchange Group — Attachments with no extension (http://www.experts-exchange.com/discussions/210281/Attachments-with-no-extension.html). This reminded me of questions tha…
Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
Suggested Courses

670 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question