NAME
hosts_access - ifomathi yeefayile zokulawula ukufikelela
INKCAZELO
Leli phepha leencwadi lichaza ulwimi olulula lokulawula ukufikelela oluxhomekeke kumxhasi (igama lomnini / idilesi, igama lomsebenzisi), kunye nomncedisi (igama lomsebenzi, igama lomphathi / idilesi). Imizekelo inikezelwa ekupheleni. Umfundi ongapheliyo uyakhuthazwa ukuba anqamle kwiCandelo leZIKHONELO zesalathisi esheshayo .Inguqulo eyongezelelweyo yolimi lokulawula ukufikelela ichazwe kwimiqulu yeemenu_iyamagama (5). Ukongezwa kuvuliwe kwithuba lokwakha inkqubo ngokwakhiwa nge -DPROCESS_OPTIONS.
Kwisibhalo esilandelayo, i- daemon yigama lomsebenzi wenqubo yedemon yenethiwekhi , kwaye umthengi ligama kunye / okanye idilesi yomsebenzi ocela isicelo. Amagama enkqubo ye-daemon yenethiwekhi ichazwe kwifayile yoqwalaselo ye-inetd.
FILE FILES
I-software yokulawula yokufikelela ihlola ezimbini iifayile . Uphando luya kumdlalo wokuqala.
Ufikelelo luya kunikwa xa iqela (daemon, umthengi) lilinganisa ukungena kwifayile ye / /etc/hosts.allow .
Ngaphandle koko, ukufikelela kuya kunqatswa xa (idayemon, umthengi) ibhangqa ukungena kwifayile ye-/etc/hosts.deny .
Ngaphandle koko, ukufikelela kuya kunikwa.
Ifayile yokulawula yokufikelela engekhoyo iphathwa njengeyifayile engenanto. Ngaloo ndlela, ulawulo lokufikelela lungakhutshwa ngokunika iifayile zokulawula ukufikelela.
IMITHETHO YOLAWULO LOKUFUMANA
Ifayile nganye yokulawula ifayile ine-zero okanye ngaphezulu imigca yesicatshulwa. Le miqolo icutshungulwa ngendlela yokubonakala. Uphando luphela xa umdlalo ufunyanwa.
Umlinganisi omtsha ungagcinwa xa ulandelwa ngumlingiswa wokubuyela emuva. Oku kukuvumela ukuba uphule imigca ende ukuze kube lula ukuhlela.
Imigca engacatshiyo okanye imigca eqala ngohlamvu lomntu '#' ayinakunyuswa. Oku kukuvumela ukuba ufake amazwana kunye ne-whitespace ukuze iitafile zilula ukufunda.
Zonke ezinye iindlela kufuneka ziyanelise ifomathi elandelayo, izinto phakathi [] ukuba zikhethiweyo:
daemon_list: client_list [: shell_command]
daemon_list uluhlu lwegama elilodwa okanye ngaphezulu kweenkqubo zeedemon (ixabiso lama-argv [0] okanye i-wildcards (jonga ngezantsi).
uluhlu lwabaxhasi_luhlu luluhlu lwamagama okanye amagama angabamkeli, idilesi zokusingatha, iipatheni okanye i-wildcards (jonga ngezantsi) eya kulandelwa ngokumelene negama lomnini wamkeli okanye idilesi.
Iifom ze- daemon eziyinkimbinkimbi @ host kunye nomsebenzisi @ umphathi zichazwe kumacandelo kwipateni yokugqibela kweseva nakwi- user loameps lookups, ngokulandelanayo.
Uludwe lwezinto kufuneka zihlukaniswe ngamabala kunye / okanye ii-commas.
Ngaphandle kwe-NIS (YP) ye-netgroup lookups, yonke i-check control controls iimeko ezingabonakaliyo.
I-PATTERNS
Ulwimi lolawulo lokufikelela lusebenzisa le ndlela ilandelayo:
Umtya oqala nge `. ' umlingiswa. Igama lokusingatha lilingana ukuba iinqununu zokugqibela zegama layo zifanisa iphethini echaziweyo. Ngokomzekelo, umzekelo `.tue.nl 'ufana negama lomthi' wzv.win.tue.nl '.
Umtya ophelela nge `. ' umlingiswa. Idilesi yokusingatha ihambelana neendawo zokuqala zeenombolo ezifanayo nomtya owenziwe. Umzekelo, umzekelo '131.155.' idibanisa idilesi (phantse) yonke imikhosi kwi-network ye-Yunivesithi yase-Eindhoven (131.155.xx).
Umtya oqala ngohlamvu lwe `` @ 'uphathwa njengeNIS (yangaphambili YP) igama lenethagi. Igama lomncedisi lihambelana nokuba ilungu lommiselo we-netgroup ecacisiweyo. Iimpawu zeNetgroup azixhaswanga ngamagama enkqubo ye-daemon okanye ngamagama abasebenzisi bamakhasimende.
Imbonakalo yefomu `nnnn / mmmm 'isetyenziswe njengombini' womnatha / umaski '. Idilesi yehostela ye-IPv4 ifaniswe ukuba 'umnatha' uyalingana ne-KUTYA kunye nedilesi kunye ne `mask '. Umzekelo, umzekelo wenetha / umatshini '131.155.72.0/255.255.254.0' udibanisa zonke idilesi kwi-'13.155.72.0 'nge `131.155.73.255'.
Imbonakalo yefomu ethi '[n: n: n: n: n: n: n: n] / m' ityhilwa njengeliso '[net] / prefixlen'. Idilesi yehostela ye-IPv6 ifaniswe ukuba 'i-prefixlen' bits 'net' ilingana 'ne-prefix' bits yedilesi. Umzekelo, i-[net] / prefixlen `[3ffe: 505: 2: 1 ::] / 64 'idibanisa nganye idilesi kwibanga' 3ffe: 505: 2: 1 :: 'nge` 3ffe: 505: 2: 1: ffff: ffff: ffff: ffff '.
Umtya oqala ngohlamvu lwe `` / 'uphathwa njengegama lefayile . Igama lomnini okanye idilesi lihambelana ukuba lihambelana naliphi na igama lomgcini okanye ipokethi yedilesi efakwe kwifayili egama. Ifomathi yefayile yi-zero okanye ngaphezulu imigca enegama elingaphezulu okanye ngaphezulu lomkhosi okanye iipateni zeedesi ezihlukaniswe ngendawo yamhlophe. Ifayile yegama lefayile ingasetyenziselwa nawuphi na igama lomninimzi okanye iphethini yeedilesi.
Wildcards `* 'kunye'? ' ingasetyenziselwa ukufanisa ama-hostnames okanye idilesi ze-IP . Le ndlela yokuhambelana ayinakusetyenziswa ngokubambisana ne-'net net / mask' efanayo, igama lomncedisi oluqhagamshelweyo ngokuqala '.' okanye idilesi ye-IP efanayo ekupheleni '.'.
WILDCARDS
Ulwimi lokulawula ufikelelo luxhasa i-wildcards ecacileyo:
BONKE
I-wildcard ye-universal, ihlala idlala.
LOCAL
Uxubusha nawuphi na umgcini ogama lakhe lingenalo uphawu lomgca.
AZIWAZI
Ufanisa nawuphi na umsebenzisi ogama lakhe lingaziwa, kwaye udibanisa nayiphi na umgcini ogama lakhe okanye idilesi engaziwayo. Le pateni kufuneka isetyenziswe ngononophelo: amagama angabamkeli angabikho ngenxa yeengxaki ze-server yegama lesigxina. Idilesi yenethwekhi ayiyi kubakho xa isofthiwe ayikwazi ukufumana uluhlobo luni lomnatha othethayo.
AZIWAZI
Ufanisa nawuphi na umsebenzisi ogama lakhe laziwa, kwaye ufanisana naliphi na umgcini ogama lakhe nedilesi eyaziwayo. Le pateni kufuneka isetyenziswe ngononophelo: amagama angabamkeli angabikho ngenxa yeengxaki ze-server yegama lesigxina. Idilesi yenethwekhi ayiyi kubakho xa isofthiwe ayikwazi ukufumana uluhlobo luni lomnatha othethayo.
PARANOID
Ukufanisa nayiphi na umgcini ogama lakhe alifani nedilesi yalo. Xa i-tcpd yakhiwe kunye ne -DPARANOID (imodeli engagqibekanga), iyancipha izicelo ezivela kubaxumi phambi kokuba zijonge iitafile zokulawula ukufikelela. Yakha ngaphandle -PARANOID xa ufuna ukulawula ngaphezulu kwezicelo ezinjalo.
ABASEBENZI
NGAPHAMBILI
Ukusetyenziswa okusetyenzisiweyo kuluhlobo: `uluhlu_1 EXCEPT list_2 '; le nto yokwakha ibambisana nantoni na efana noluhlu_1 ngaphandle kokuba lufanisa uluhlu_2 . Umqhubi we-EXCEPT angasetyenziselwa kwi-daemon_lists nakwi-client_lists. Umqhubi we-EXCEPT angaba nendlu: ukuba ulwimi lolawulo luya kuvumela ukusetshenziswa kwabazali, "UKUQALA UKUQALA" kuya kuhamba ngokuthi '(EXCEPT (b FUMANA c))'.
Ukuba umgaqo wokulawula wokufikelela wokulinganisa uqulethe umyalelo wegobolondo, loo myalelo uphantsi kweengxenye% (jonga icandelo elilandelayo). Isiphumo senziwa yinkqubo yomntwana / ibin / sh ngokufakelwa komgangatho osemgangathweni, umphumo kunye nephutha elixhunyiwe kwi / dev / null . Cacisa i & `& 'ekupheleni komyalelo ukuba awufuni ukulinda de ukuba igqibe.
Imithetho ye-Shell akufanele ixhomekeke kwi-PATH yokubeka i-inetd. Kunoko, bafanele basebenzise amagama asemgangathweni, okanye bafanele baqale ngePATH ecacileyo = nayiphi na ingxelo.
I- host_options (5) idokethi ichaza ulwimi oluthile olusebenzisa insimu yomyalelo wegobolondo ngendlela engafaniyo.
% IIMVIWO
Ezi zilandelayo zikhoyo zifumaneka kwii-shell shell:
% (% A)
Idilesi yomxhasi (umncedisi).
% c
Ulwazi lomthengi: umsebenzisi @ ummkeli, umsebenzisi @ idilesi, igama lomnini, okanye idilesi, kuxhomekeke kwindlela eninzi ulwazi olukhoyo.
% d
Igama leprogram ye-daemon (xabiso [0] xabiso).
% h (% H)
Igama lomthengi (umncedisi) igama lomnini okanye idilesi, ukuba igama lomncedi alitholakali.
% n (% N)
Igama lomthengi (umncedisi) igama lomphathi (okanye "engaziwa" okanye "i-paranoid").
% iphe
Inkqubo yedemo yedemon.
% s
Ulwazi lomncedisi: daemon @ host, daemon @ idilesi, okanye igama nje legama leedemon, kuxhomekeke kwindlela eninzi ulwazi olutholakala ngayo.
% u
Igama lomsebenzisi lomsebenzisi (okanye "ongaziwa").
%%
Ukunyuka kwiqela elilodwa '%'.
Abalingani kwi-% expansions ezingadibanisa iigobolondo zithatyathwa ngokugqithiswa.
ISERVER ENDPOINT PATTERNS
Ukuze uhlukanise abathengi ngedilesi yenethiwekhi abaxhuma kuyo, sebenzisa iipatheni zefomu:
inkqubo_name @ host_pattern: client_list ...
Iipatheni ezifana nalezi zingasetyenziswa xa umatshini enee-aderesi ze-intanethi ezahlukeneyo ngegama le-hostnames ezahlukeneyo. Abanikezeli benkonzo bangasebenzisa esi sikhungo ukuba banikezele ngeengxelo ze-FTP, GOPHER okanye i-WWW ngamagama e-intanethi angabakho kwimibutho eyahlukeneyo. Qaphela kwakhona inketho 'yokuguqula' kwi- host_options (5) idokhumenti. Ezinye iinkqubo (i-Solaris, i-FreeBSD) inakho idilesi enye ye-intanethi kwi-interface eyodwa; kunye nezinye iinkqubo onokufuneka usebenzise kuzo kwi-SLIP okanye i-PPP ye-interfaces yomnxeba ohlala kwindawo yokudibanisa idilesi yenethiwekhi.
Umphathi we_mphathi uthobela imithetho efanayo ye-syntax njengegama lomnini kunye needesi kumxholo we client_list. Ngokuqhelekileyo, ulwazi lomgca we-endpoint lufumaneka kuphela ngeenkonzo ezinxulumene noxhumano.
UMCWADI USERNAME UKUBHALA
Xa umxhasi umxhasi exhasa i-protocol ye-RFC 931 okanye enye yenzalo yayo (i-TAP, IDENT, i-RFC 1413) iiprogram ze-wrapper ziyakwazi ukufumana ulwazi olongezelelweyo malunga nomnini woxhumano. Ulwazi lomsebenzisi lomsebenzisi, xa lukhona, luxhunywe kunye negama lomxhasi lomxhasi, kwaye lingasetyenziselwa ukufanisa amaphetheni afana:
daemon_list: ... user_pattern @ host_pattern ...
I-daemon wrappers ingaqwalaselwa ngexesha lokuqulunqa ixesha lokwenza i-lookups yomsebenzisi (egqibeleleyo) okanye ukuhlala uphinda uphandle umxhasi womxhasi. Kwimeko yegama lomsebenzisi elilawulwa ngumthetho , umgaqo olapha ngasentla ungenza igama lomsebenzisi likhangele kuphela xa zombini i- daemon_list kunye nomdlalo we- host_pattern .
Umzekelo womsebenzisi unesigxina esifanayo njengendlela yokwenza i-daemon, ngoko i-wildcards efanayo isebenza (ubulungu be-netgroup abuxhaswanga). Omnye akufanele athathwe ngegama lomsebenzisi, nangona kunjalo.
Ulwazi lomsebenzisi lomsebenzisi alukwazi ukuthenjwa xa luyimfuneko kakhulu, oko kukuthi xa inkqubo yomxhasi ibonakaliswe. Ngokubanzi, BONKE kunye (i-UN) AZIWAZI kuphela iipateni zamagama ezisebenzayo ezibonisa ingqiqo.
Igama lokungena lomsebenzisi linokwenzeka kuphela ngeenkonzo ze-TCP, kwaye kuphela xa umphathi weklayenti eqhuba idemon efanelekileyo; kuzo zonke ezinye iimeko umphumo "ongaziwa".
I-UNIX kernel bug engaziwayo ingabangela ukulahlekelwa kweenkonzo xa i-lookumagama yomsebenzisi ivinjiwe ngumlilo wokutshisa umlilo. Umbhalo we-README wrapper uchaza inkqubo yokufumana ukuba i-kernel yakho ine-bug.
Igama lokungena lomsebenzisi linokubangela ukulibaziseka okubonakalayo kubasebenzisi abangewona i-UNIX. Isikhathi sokungagqibekanga sokungena kwegama lomsebenzisi yimigqa e-10: mfutshane kakhulu ukuhlangabezana neenethiwekhi ezinqamlekileyo, kodwa ixesha elide lokwenzela abantu abasebenzisa i-PC.
Ukhetho lomsebenzisi olukhethiweyo lunokunciphisa ingxaki yokugqibela. Umzekelo, umgaqo onjenge:
daemon_list: @pcnetgroup ZONKE @ ZONKE
iya kumelana namalungu e-pc netgroup ngaphandle kokwenza igama lomsebenzisi, kodwa uza kwenza igama lomsebenzisi kunye nezinye iisistim.
UKUKHETHA UKUBHALA KWI-ADDRESS
Iphutha ekulandelelaneni kwenombolo ye-generator yeenkqubo ezininzi ze-TCP / IP zivumela abasebenzisi ukuba benze ngokufanayo imikhosi ethembekileyo kunye nokungena kwi-shell yeenkonzo ze-shell shell. I-IDENT (RFC931 njl.) Njlnkonzo ingasetyenziswa ukufumanisa ukuhlaselwa kwezixhobo zokukhupha idilesi kunye nezinye.
Ngaphambi kokuba samkele isicelo somthengi, i-wrappers ingasebenzisa inkonzo ye-IDENT ukuze ifumanise ukuba umthengi akazange athumele isicelo sonke. Xa umnikeli womthengi unikela ngenkonzo ye-IDENT, umphumo ongeyiphumo lokungena kwi-IDENT (umxhasi ufana 'UNGUNZIWE @ umphathi') ubungqina obuqinileyo bokuhlaselwa kwe-spoofing host.
Isiphumo esihle sokungena kwi-IDENT (umthengi ufana 'KUNYE @ umphathi') ayithembekanga kangako. Kungenzeka ukuba inambuku ilahleke umnxibelelwano womxhasi kunye ne-IDENT yokujonga, nangona ukwenza njalo kunzima kunokuba ukhuphaze uxhumo lomxhasi kuphela. Kungathi kwakhona ukuba umncedisi we-IDENT yomnxeba ulala.
Qaphela: i-IDENT lookups ayisebenzi kunye neenkonzo ze-UDP.
I MI ZEKELO
Ulwimi luguquguquka ngokwaneleyo ukuba iintlobo ezahlukeneyo zokulawula ukufikelela zingabonakaliswa ngokuncinci. Nangona ulwimi lisebenzisa itafile ezimbini zokulawula ukufikelela, imigaqo-nkqubo eqhelekileyo inokusetyenziswa kunye nelinye lamatafula lincinci okanye lungekho.
Xa ufunda imizekelo engezantsi kubalulekile ukuba uqaphele ukuba i-table evumelayo ichithwa ngaphambi kokukhanyela itafile, ukuba ukukhangela kuphelisa xa umdlalo ufunyenwe, kwaye oko kufumaneka xa kungekho mdlalo ufunyanwa nonke.
Imizekelo isebenzise amagama omncedisi kunye negama lesizinda. Baya kuphuculwa ngokubandakanya idilesi kunye / okanye inethiwekhi / ulwazi lwe-netmask, ukunciphisa impembelelo ye-server yexeshana yokungaphumeleli kwiseva.
KUVALWE
Kule meko, ukufikelela kungavunyelwa ngokungagqibekanga. Imikhosi egunyazisiweyo ephela ivumelekile ukufikelela.
Umgaqo-nkqubo ongagqibekanga (akukho ukufikelela) uphunyezwe ngefayili encinane yokukhanyela:
/etc/hosts.deny: ZONKE: ZONKE
Oku kukwenzela yonke inkonzo kuyo yonke imikhosi, ngaphandle kokuba ivumelekile ukungena ngokufakela kwifayile evumelekileyo.
Imikhosi egunyazisiweyo ichazwe kwifayili evumelekileyo. Umzekelo:
/etc/hosthosts.allow: ZONKE: LOCAL @some_netgroup
ZONKE: .foobar.edu PHEKA i-terminalserver.foobar.edu
Umgaqo wokuqala uvumela ukufikelela kwimimandla kwi-domain yangasese (akukho `. ' Kwigama lomngenisa) kunye nakwamalungu e - net_rougroup netgroup. Umgaqo wesibini uvumela ukufikelela kuyo yonke imikhosi kwi-domain ye foobar.edu (qaphela ichaphaza elikhokelayo), ngaphandle kwe-terminalserver.foobar.edu .
KUVELA
Apha, ukufikelela kufakwa ngokungaqhelekanga; imikhosi echazwe ngokucacileyo inqatshelwe inkonzo.
Umgaqo-nkqubo ongagqibekanga (ukunikezelwa kunikwe) kwenza ukuba ifayile evumelekileyo ibe yinto evulekileyo ukuze ikhutshwe. Imikhosi engabonakaliyo egunyazisiweyo ibalwe kwifayile yokukhanyela. Umzekelo:
/etc/hosts.deny: ZONKE: ezinye.host.name, .some.domain
NONKE NGAPHAMBILI ku.fingerd: enye.hostname.name, .other.domain
Umgaqo wokuqala ulahla ezinye iimithombo kunye nezizinda zonke iinkonzo; Umgaqo wesibini uvumela izicelo zamunwe zivela kwezinye iindawo kunye nemimandla.
ZOKUBHALA
Umzekelo olandelayo uvumela izicelo ze-tftp kwimikhosi kummandla wendawo (qaphela ichaphaza elikhokelayo). Izicelo ezivela kuyo nayiphi na enye imikhosi ziphihliwe. Esikhundleni sefayile eceliwe, iprogram yomunwe ithunyelwa kumninimzi ongekho. Isiphumo sithunyelwa kwi-superuser.
/etc/hosthosts:
in.tftpd: I-LOCAL, .my.domain /etc/hosts.deny: in.tftpd: YONKE: i-spawn (/ ezinye / apho / iphephile_ngxaki -l @% h | \ / usr / ucb / imeyile -s% d-% i ingcambu) &Umyalelo ophephile_i-ephephayo uza ne-tcpd wrapper kwaye kufuneka ifakwe kwindawo efanelekileyo. Iphelisa umonakalo ongenakwenzeka kumnxeba othunyelwe ngumncedisi wesinxele esikude. Inika ukukhusela okungcono kunomyalelo wokunyusa umnwe.
Ukwandiswa kwe-% h (ummkeli wabaxhasi) kunye ne% d (igama leenkonzo) ukulandelelana kuchazwe kwicandelo kwiimigca yeekhlig.
Isilumkiso: musa u-booby-ugibe i daemon yakho ngomunwe, ngaphandle kokuba ulungele ukungena eminwe eminwe.
Kwiinkqubo ze-firewall zenethwekhi le nkohliso inokuqhutyelwa phambili. I-firewall yomnatha yomnatha inika kuphela isethi esinqununu seenkonzo kwilizwe langaphandle. Zonke ezinye iinkonzo zinokuthi "zixhunywe" njengolu hlobo olungentla ngentla. Isiphumo sisistim esilungileyo sokuqala.
BONA KWAKHO
I-tcpd (8) inkqubo ye-tcp / ip ye-daemon yo-wrapper. tcpdchk (8), tcpdmatch (8), iinkqubo zokuvavanya.Kubalulekile: Sebenzisa umyalelo womntu ( % umntu ) ukubona indlela umyalelo usetyenziswa ngayo kwiikhomputha yakho ethile.