Web site management - Chapter 6 . Securing Linux 215 . A
Chapter 6 . Securing Linux 215 . A string that begins with an at (@) sign is treated as an NIS netgroup name. A host name is matched if it is a host member of the specified netgroup. Netgroup matches are not supported for daemon process names or for client user names. . An expression of the form n.n.n.n/m.m.m.m is interpreted as a net/mask pair. A host address is matched if net is equal to the bitwise and of the address and the mask. For example, the net/mask pattern 131.155.72.0/255.255.254.0 matches every address in the range 131.155.72.0 through 131.155.73.255. The example host.allow contains the first two types of client specification. The entry 199.170.177. will match any IP address that begins with that string, such as 199.170.177.25. The client entry .linuxtoys.net will match host names such as jukebox.linuxtoys.net or picframe.linuxtoys.net. Let s examine what happens when a host named jukebox.linuxtoys.net (with IP address 199.170.179.18) connects to your Linux system using the Telnet protocol. In this case, the Linux system is Fedora, which uses the xinetd daemon to listen for service requests associated with TCP wrappers: 1. xinetd receives the connection request. 2. xinetd begins comparing the address and name of jukebox.linuxtoys.net to the rules listed in /etc/hosts.allow. It starts at the top of the file and works its way down the file until finding a match. Both the daemon (the program handling the network service on your Fedora box) and the connecting client s IP address or name must match the information in the hosts.allow file. In this case, the second rule that is encountered matches the request: in.telnetd: 199.170.177., .linuxtoys.net 3. The jukebox host is not in the 199.170.177 subnet, but it is in the linuxtoys.net domain. xinetd stops searching the file as soon as it finds this match. How about if jukebox connects to your box using the CUPS-lpd protocol? In this case, it matches none of the rules in hosts.allow; the only line that refers to the lpd daemon does not refer to the 199.170.179 subnet or to the linuxtoys.net domain. xinetd continues on to the hosts.deny file. The entry ALL: ALL matches anything, so tcpd denies the connection. The ALL wildcard was also used in the hosts.allow file. In this case, we are telling xinetd to permit absolutely any host to connect to the FTP service on the Linux box. This is appropriate for running an anonymous FTP server that anyone on the Internet can access. If you are not running an anonymous FTP site, you probably should not use the ALL flag. A good rule of thumb is to make your hosts.allow and hosts.deny files as restrictive as possible and then explicitly enable only those services that you really need. Also, grant access only to those systems that really need access. Using the ALL flag to grant universal access to a particular service may be easier than typing
Check Tomcat Web Hosting services for best quality webspace to host your web application.