{"id":1063,"date":"2010-03-08T11:19:00","date_gmt":"2010-03-08T03:19:00","guid":{"rendered":"\/?p=1063"},"modified":"2010-03-08T11:19:00","modified_gmt":"2010-03-08T11:19:00","slug":"1063","status":"publish","type":"post","link":"https:\/\/blog.vimge.com\/archives\/linux\/1063.html","title":{"rendered":"\u4f7f\u7528xinetd"},"content":{"rendered":"
\u4f5c\u8005\uff1aJose Nazario
\u8bd1\u8005\uff1aFenng
\u65e5\u671f\uff1a25-Oct-2004
\u51fa\u5904\uff1ahttp:\/\/www.dbanotes.net
\u7248\u672c\uff1a@2001\/11\/27 Version 0.01@2003\/05\/23 Version 1.00<\/div>\n
Jose\u63cf\u8ff0\u4e86\u5982\u4f55\u7740\u624b\u914d\u7f6e\u8c03\u6574xinetd<\/acronym>\u3002<\/p>\n xinetd<\/acronym>\u53d6\u4ee3\u4e86 inetd\uff0c\u5e76\u4e14\u63d0\u4f9b\u4e86\u8bbf\u95ee\u63a7\u5236\u3001\u52a0\u5f3a\u7684\u65e5\u5fd7\u548c\u8d44\u6e90\u7ba1\u7406\u529f\u80fd\u3002xinetd<\/acronym>\u5df2\u7ecf\u6210\u4e3aRed Hat 7 \u548c Mandrake7.2\u7684Internet\u6807\u51c6\u8d85\u7ea7\u5b88\u62a4\u8fdb\u7a0b\u3002\u8fd9\u7bc7\u6587\u7ae0\u5c06\u5f15\u5bfc\u4f60\u5982\u4f55\u5e94\u7528\u4e00\u4e9b\u5b83\u7684\u7279\u6027\uff0c\u8fd9\u4e9b\u7279\u6027\u57fa\u4e8exinetd<\/acronym> 2.1.8.8 pre3\u7248\u672c\u3002<\/p>\n xinetd<\/acronym>\u7684\u6700\u521d\u7684\u4f5c \u8005\uff08Panagoitis Tsirigotis panos@cs.colorado.edu\uff09\u597d\u50cf\u5df2\u7ecf\u505c\u6b62\u4e86\u8fd9\u4e2a\u9879\u76ee\u3002 Rob Braun(bbraun@synack.net)\u7ee7\u7eed\u4e86\u8be5\u9879\u76ee\uff0c\u73b0\u5728\u8d1f\u8d23\u7ef4\u62a4\u8fd9\u4e2a\u8f6f\u4ef6\u5305\u3002\u4e3a\u4e86\u80fd\u4f7fselect()\u5728\u6211\u7684\u8001\u7684libc5\u7cfb\u7edf\u4e0a\u4e5f\u53ef\u4ee5\u4f7f\u7528\uff0c\u6211\u4e0d\u5f97\u4e0d\u7ed9\u5f53\u524d\u7684\u5305\u6dfb\u52a0\u51e0\u5bf9\u5934\u6587\u4ef6\uff0c\u8fd9\u662f\u6211\u6ce8\u610f\u5230\u7684\u95ee\u9898\u3002\u6216\u8bb8\u4f60\u9700\u8981\u5b83\u4eec\uff0c\u5982\u4e0b\uff1a<\/p>\n xinetd<\/acronym>\u7528\u62ec\u53f7\u62ec\u8d77 \u7684\u3001\u6269\u5c55\u4e86\u7684\u8bed\u6cd5\u53d6\u4ee3\u4e86inetd\u4e2d\u7684\u901a\u7528\u7684\u884c\u3002\u53e6\u5916\uff0c\u8fd8\u6dfb\u52a0\u4e86\u65e5\u5fd7\u548c\u8bbf\u95ee\u63a7\u5236\u529f\u80fd\u3002 \u867d\u7136inetd\u53ef\u4ee5\u4f7f\u7528Venema\u7684 tcp_wrappers\u8f6f\u4ef6 (tcpd) \u63a7\u5236 TCP \u7684\u8fde\u63a5\uff0c\u4f46\u662f\u4f60\u4e0d\u80fd\u7528\u5b83\u6765\u63a7\u5236 UDP\u8fde\u63a5\u3002\u6b64\u5916\uff0cinetd\u5bf9RPC(portmapper)\u7c7b\u578b\u7684\u670d\u52a1\u4e5f\u5904\u7406\u4e0d\u597d\u3002\u53e6\u5916\uff0c\u867d\u7136\u4f7f\u7528 inetd \u4f60\u53ef\u4ee5\u63a7\u5236\u8fde\u63a5\u901f\u5ea6( \u901a\u8fc7\u7ed9wait\u6216\u662fno wait \u53d8\u91cf\u9644\u52a0\u4e00\u4e2a\u6570\u503c\uff0c\u4f8b\u5982nowait.1\u8868\u793a\u6bcf\u9694\u4e00\u79d2\u949f\u4e00\u4e2a\u5b9e\u4f8b)\uff0c\u4f60\u4e0d\u80fd\u63a7\u5236\u5b9e\u4f8b\u7684\u6700\u5927\u6570\u3002 \u8fd9\u80fd\u5bfc\u81f4\u8fdb\u7a0b\u8868\u653b\u51fb\uff08\u4f8b\u5982\uff0c\u4e00\u4e2a\u6709\u6548\u7684\u62d2\u7edd\u670d\u52a1\u653b\u51fb\uff09\u3002\u901a\u8fc7\u4f7f\u7528xinetd<\/acronym>\uff0c\u6211\u4eec\u53ef\u4ee5\u9632\u6b62Dos<\/acronym>\u3002<\/p>\n \u6211\u901a\u5e38\u4f7f\u7528\u4e0b\u9762\u7684\u547d\u4ee4\u542f\u52a8xinetd<\/acronym>\uff0c \u628a\u5b83\u653e\u5728\u6211\u7684Internet\u670d\u52a1\u542f\u52a8\u811a\u672c\u4e2d\uff1a<\/p>\n \u8fd9\u544a\u8bc9 xinetd<\/acronym>\u5bf9\u6240\u6709\u7684\u670d\u52a1\u90fd\u8fdb\u884c\u7eaa\u5f55\uff0c\u65e5\u5fd7\u4fdd\u5b58\u5230\u6587\u4ef6\/var\/adm\/xinetd.log\u4e2d\uff0c\u5e76\u4e14\u4f7f\u7528\u914d\u7f6e\u6587\u4ef6\/etc\/xinetd.conf\u3002\u8fd9\u7bc7\u6587\u7ae0\u4e2d\u7684\u5927\u91cf\u7bc7\u5e45\u90fd\u5c06\u7528\u5728\u8fd9\u4e2a\u914d\u7f6e\u6587\u4ef6\u4e0a\u3002<\/p>\n \u4f60\u5e94\u8be5\u6ce8\u610f3\u4e2a\u7f16\u8bd1\u65f6\u7684\u9009\u9879\uff1alibwrap\u3001loadavg (\u7528\u4e8e\u76d1\u89c6\u8d1f\u8f7d\u5747\u8861) \u548c IPv6support\uff0c\u5b83\u4eec\u63d0\u4f9b\u4e86\u989d\u5916\u7684\u8bbf\u95ee\u63a7\u5236\u3002\u5bf9\u4e8e\u5927\u591a\u6570libwrap"\u660e\u767d"\u7684\u5b88\u62a4\u8fdb\u7a0b (\u5982portmapper\u548csendmail)\uff0c\u5728\u914d\u7f6e\u811a\u672c\u4e2d\u7684"with-libwrap"\u9009\u9879\u544a\u8bc9xinetd<\/acronym>\u652f\u6301tcp_wrappers\u6587\u4ef6\/etc\/hosts.allow\u548c\/etc \/hosts.deny\u3002\u8fd9\u4e9b\u9009\u9879\u5bf9xinetd<\/acronym>\u4f5c \u7528\u5c31\u5982\u540c\u5b83\u4eec\u4e4b\u4e8e inetd\u90a3\u6837\uff0c\u5e76\u4e14\u652f\u6301\u6240\u6709\u7684 xinetd\u63a7\u5236\u7684\u5b88\u62a4\u8fdb\u7a0b\u3002\u6ce8\u610f\u5982\u679c\u4f60\u4ece\u96f6\u5f00\u59cb\u505axinetd<\/acronym>\u7684\u8bdd\uff0c\u5c31\u53ef\u4ee5\u505a\u8bbf\u95ee\u63a7\u5236\uff0c\u4e0d\u518d \u9700\u8981tcpd\u3002\u4e0d\u7ba1\u600e\u6837\u3002\u5bf9libwrap \u7684\u652f\u6301\u662f\u6709\u7528\u7684–\u5982\u679c\u4f60\u4eceinetd\/tcpd\u8fc1\u79fb\u5e76\u4e14\u4e5f\u4e0d\u60f3\u6539\u53d8\u4f60\u7684\u8bbf\u95ee\u6587\u4ef6\u7684\u8bdd \u3002<\/p>\n \u7b2c\u4e8c\u4e2a\u6709\u8da3\u7684\u8bbe\u7f6e\u9009\u9879\u662f\u652f\u6301\u8d1f\u8f7d\u5747\u8861\u76d1\u63a7\uff0c\u901a\u8fc7\u5728.\/configure\u811a\u672c\u4e2d\u4f7f\u7528with-loadavg\u9009\u9879\u53ef\u4ee5\u8fbe\u5230\u3002sendmail\u652f\u6301\u5728\u9ad8\u8d1f\u8f7d \u7684\u65f6\u5019\u505c\u6b62\u8fde\u63a5–\u5047\u5b9a\u5b83\u5df2\u7ecf\u8131\u79bb\u4e86\u63a7\u5236\u5e76\u4e14\u6b63\u5728\u5f53\u6389\u673a\u5668\u3002\u7528\u8fd9\u4e2a\u9009\u9879\u53ef\u4ee5\u6fc0\u6d3bmax_load \u9009\u9879\u4ee5\u9650\u5236\u4efb\u4f55\u8fde\u63a5\u6216\u662f\u57fa\u4e8e\u8d1f\u8f7d\u5747\u8861\u673a\u5668\u7684\u6240\u6709\u670d\u52a1\u3002<\/p>\n \u6700\u540e\uff0c\u6dfb\u52a0 IPv6\u652f\u6301 \u53ef\u4ee5\u901a\u8fc7\u5728 .\/configure \u811a\u672c\u4e2d\u4f7f\u7528 with-inet6 capability\u9009\u9879\u6765\u5b8c\u6210\u3002 \u8fd9\u4f7fxinetd<\/acronym>\u652f\u6301IPv6\u5730\u5740\u548c\u8fde\u63a5\u3002\u6ce8\u610f\u8981\u4f7f\u5176\u751f\u6548\u7684\u8bdd\u4f60\u7684\u6838\u5fc3\uff08\u548c\u7f51\u7edc\uff09\u5fc5\u987b\u652f\u6301 IPv6\u3002\u5f53\u7136IPv4 \u4ecd\u7136\u88ab\u652f\u6301\u3002<\/p>\n xinetd<\/acronym>\u914d\u7f6e\u6587\u4ef6\uff0c\u901a\u5e38\u53ef\u4ee5\u624b\u5de5\u6216\u662f\u81ea\u52a8\u4eceinetd.conf\u6587\u4ef6\u751f\u6210\u3002\u524d\u8005\u8d39\u65f6\u95f4\u4e14\u5bb9\u6613\u51fa\u9519\uff1b\u540e\u8005\u53ef\u4ee5\u901a\u8fc7 itox\u8f6f\u4ef6\u6216\u8005xconv.pl\u811a\u672c\u8f7b\u6613\u5b8c\u6210\u3002\u867d\u7136itox\u8f6f\u4ef6\u6b63\u5728\u88ab\u53d6\u6d88\u800c\u503e\u5411\u4e8e\u4f7f\u7528 xconv.pl\u811a\u672c\uff0c\u5b83\u4ecd\u662f\u5f88\u6709\u7528\u7684\u3002\u4f46\u662f\uff0c\u8981\u6ce8\u610f\u91cd\u590d\u7684\u8fd0\u884c\u5b83\u4f1a\u8986\u76d6\u539f\u6709\u7684\u914d\u7f6e\u6587\u4ef6\u3002itox\u548cxconv\u90fd\u4ee5\u540c\u6837\u7684\u65b9\u5f0f\u5de5\u4f5c\uff0c\u6211\u4eec\u7528 itox\u6765\u8fdb\u884c\u6f14\u793a\uff1a<\/p>\n \u65b0\u4e00\u4e9b\u7684\u5de5\u5177\uff08xconv\uff09\u53ef\u4ee5\u7406\u89e3\u6ce8\u91ca\uff0c\u5e76\u4e14\u5728\u5bf9tcpd\u7684\u4f7f\u7528\u4e0a\u8981\u6bd4itox\u505a\u5f97\u66f4\u597d\uff0c\u4f7f\u7528itox\uff0c\u4f60\u4e0d\u5f97\u4e0d\u6307\u5b9a\u5b88\u62a4\u8fdb\u7a0b\u7684\u8def\u5f84 \uff08\u5982\/usr\/sbin\uff09\u3002 \u4f60\u60f3\u8981\u5305\u542b\u7684\u7b2c\u4e00\u6bb5\u5c31\u662f\u9ed8\u8ba4\u7684\u6bb5\uff0c\u5c31\u50cf\u540d\u5b57\u6697\u793a\u7684\u90a3\u6837\uff0c\u9ed8\u8ba4\u7684xinetd<\/acronym>\u670d\u52a1\u3002<\/p>\n \u9a6c\u4e0a\uff0c\u6211\u4eec\u53ef\u4ee5\u4e86\u89e3 xinetd<\/acronym>\u8bbe\u7f6e\u53c2\u6570\u7684\u8bed\u6cd5\uff1a<\u6307\u793a\uff08directive\uff09> <\u64cd\u4f5c\u7b26\uff08operator\uff09> <\u503c\uff08value\uff09>\u3002xinetd<\/acronym>\u6240\u80fd\u7406\u89e3\u7684\u6307\u793a\u5217\u5728\u8868\u4e00\u4e2d\uff0c \u5728\u8fd9\u91cc\u6211\u4eec\u5c06\u5ffd\u7565 flags\u3001type\u3001env \u548cpassenv\u6307\u793a\u7b26\u3002 \u6211\u5bf9\u5c06\u5bf9 only_from \u548cno_access\u4ee5\u53ca\u989d\u5916\u7684\u65e5\u5fd7\u9009\u9879\u52a0\u4ee5\u66f4\u591a\u7684\u8ba8\u8bba<\/p>\n \u64cd\u4f5c\u7b26\u975e\u5e38\u7b80\u5355\uff0c\u201c=\u201d\u6216\u8005\u201c+=\u201d\u3002\u7528 =\uff0c\u53f3\u8fb9\u7ed9\u5b9a\u7684\u503c\u4f20\u7ed9\u5de6\u8fb9\u7684\u6307\u793a\u7b26\u3002+=\u4e5f\u662f\u975e\u5e38\u76f4\u63a5\u7684\uff0c \u7528\u4e8e\u7ed9\u4e00\u4e2a\u5df2\u7ecf\u6307\u5b9a\u7684\u6307\u793a\u7b26\u6dfb\u52a0\u4e00\u4e2a\u503c\u3002\u6ca1\u6709\u5b83\uff0c\u539f\u5148\u7684\u6307\u793a\u7b26\u5c31\u4f1a\u88ab\u8986\u76d6\uff0c\u8fd9\u6837\u53ef\u4ee5\u7528\u6765\u5c55\u5f00 \u8bbf\u95ee\u5217\u8868\uff0c\u6216\u8005\u8de8\u8d8a\u591a\u884c\u3002<\/p>\n \u7528\u5982\u4e0b\u7684\u683c\u5f0f\u63cf\u8ff0\u670d\u52a1\uff1a<\/p>\n \u670d\u52a1\u540d\u3000 \u670d\u52a1\u540d\u4e00\u5b9a\u8981\u5728 \/etc\/services\u5217\u51fa \uff0c\u5e76\u4e14\u8981\u4f7f\u7528\u5408\u9002\u7684socket\u548c\u534f\u8bae\u3002<\/p>\n \u5173\u4e8e\u8bbf\u95ee\u63a7\u5236\u7684\u6709\u51e0\u53e5\u8bdd\u3002 \u9996\u5148\uff0cxinetd<\/acronym>\u63a7 \u5236\u8fde\u63a5\u800c\u4e0d\u662f\u63a7\u5236\u6570\u636e\u5206\u7ec4\uff0c\u5b83\u53ea\u662f\u4e2a\u7528\u6237\u65b9\u7684\u5b88\u62a4\u8fdb\u7a0b\uff0c\u5982\u540cinetd\u4e00\u6837\u3002\u540c\u6837\u7684\uff0c\u53ef\u4ee5\u6253\u65ad\u4e00\u4e2a\u88ab\u670d\u52a1\u5668\u7981\u6b62\u7684\u4e3b\u673a\u7684SYN\u6216\u662fconnect()\u3002\u4f46\u4e0d\u80fd\u4e2d\u6b62\u8c61FIN [\u7aef\u53e3\u626b\u63cf\u4f7f\u7528\u5e26\u6709FIN\u6807\u5fd7\u4f4d\u7684TCP\u5305\uff0c\u901a\u5e38\u662fnmap\u8fd9\u6837\u7684\u5de5\u5177\u8fd0\u884c\u4ea7\u751f\u7684]\u8fd9\u6837\u7684"\u79d8\u5bc6" \u626b\u63cf\u3002\u4e0d\u8981\u628axinetd<\/acronym> \u5f53\u4f5c\u4e00\u4e2afirewall\u7528\u4ee5\u963b\u6b62\u7aef\u53e3\u626b\u63cf\u3002\u4e00\u4e2a\u6709\u7ecf\u9a8c\u7684\u5165\u4fb5\u8005\u80fd\u591f\u7528\u8fd9\u4e9b\u4fe1\u606f\u6536\u96c6\u4f60\u7684\u4e0d\u540c\u670d\u52a1\u7684\u8bbf\u95ee\u63a7\u5236\u5217\u8868\u3002\u5e78\u8fd0\u7684\u662f,\u8fd9\u4e9b\u53ef\u4ee5\u88abxinetd\u7eaa\u5f55\u3002\u5f53\u4f60\u770b\u5230\u65e5\u5fd7\u7684\u65f6\u5019\u4f60\u7684\u7591\u8651\u4f1a\u6d88\u9664\u7684\u3002<\/p>\n \u7b2c\u4e8c\uff0cxinetd<\/acronym>\uff082.1.8.8pre3 \u7248\u672c\uff09\uff0c\u5f53\u4e00\u4e2a\u7cfb\u7edf\u8bd5\u56fe\u8fde\u63a5\u7684\u65f6\u5019\u8fdb\u884c\u540d\u5b57\u67e5\u627e\u3002\u4ee5\u524d\uff0c\u5b83\u5728\u542f\u52a8\u7684\u65f6\u5019\u8fdb\u884c\u67e5\u627e\uff0c \u4f46\u662f\u73b0\u5728\u5df2\u7ecf\u6539\u53d8\u3002<\/p>\n \u4f7f\u7528\u8bbf\u95ee\u63a7\u5236\u771f\u7684\u5f88\u7b80\u5355\u3002\u7b2c\u4e00\u4e2a\u6307\u793a\u7b26\u662f only_from, \u5217\u51fa\u4e86\u6211\u4eec\u53ef\u4ee5\u63a5\u53d7\u4ece\u54ea\u4e00\u4e2a\u7f51\u7edc\u6216\u662f\u4e3b\u673a\u7684\u8fde\u63a5\u3002\u8fd9\u4e2a\u89c4\u5219\u53ef\u4ee5\u88abno_access\u8986\u76d6\u3002 \u4f60\u53ef\u4ee5\u4f7f\u7528\u7f51\u7edc\u53f7\uff0c\u5982 10.0.0.0 \u6216\u8005 10\u6216\u8005\u662f\u7f51\u7edc\u540d\uff08\u5305\u62ec .my.com \u6216\u8005.my.com\uff09\u3002\u4e3b\u673a\u540d\u6216\u8005\u4e3b\u673a\u7684 IP\u5730\u5740\u4e5f\u53ef\u4ee5\u5728\u8fd9\u91cc\u4f7f\u7528\u6307\u793a\u7b260.0.0.0 \u5339\u914d\u6240\u6709\u7684\u4e3b\u673a\u5e76\u76d1\u542c\u6240\u6709\u7684\u5730\u5740\u3002\u901a\u8fc7\u4f7f\u7528no_access\u4e00\u65e6\u7b26\u5408\u6807\u51c6\u62d2\u7edd\u5c31\u4f1a\u88ab\u89e3\u6790\u3002\u518d\u8bf4\u4e00\u904d\uff0c\u7f51\u7edc\u548c\u4e3b\u673a\u53ef\u4ee5\u6307\u5b9a\u3002<\/p>\n \u8ba9\u6211\u4eec\u770b\u4e00\u4e9b\u57fa\u672c\u7684\u5e94\u7528\u3002\u6211\u4eec\u5148\u770b\u7b2c\u4e00\u4e2a\u57fa\u672c\u7684\u670d\u52a1echo\uff0c\u5b83\u662finetd \u548cxinetd<\/acronym>\u56fa\u6709\u7684\u670d\u52a1\u3002<\/p>\n echo \u4ee5root\u6743\u9650\u8fd0\u884c, \u662f\u4e00\u4e2atcp \u6d41\u5e76\u5728\u5185\u90e8\u5904\u7406\u3002echo-stream\u6307\u793a\u7b26\u5c06\u51fa\u73b0\u5728\u65e5\u5fd7\u4e2d\u3002\u5982\u679c\u6ca1\u6709only_from\u6216\u662fno_access\u5728\u6307\u793a\u7b26\u4e2d,\u5bf9\u8fd9\u4e2a\u670d\u52a1\u7684\u8bbf\u95ee\u7684\u914d\u7f6e\u5c06\u662f\u4e0d\u53d7\u9650\u5236\u7684\u3002<\/p>\n \u73b0\u5728\uff0c\u8ba9\u6211\u4eec\u770b\u4e00\u4e2a\u6b63\u89c4\u7684\u670d\u52a1\uff0cdaytime\uff1a<\/p>\n \u518d\u8bf4\u4e00\u6b21\uff0c\u4efb\u4f55\u4eba\u90fd\u53ef\u4ee5\u8fde\u63a5,\u4e0d\u8fc7\u6211\u4eec\u6307\u660e\u5b83\u4ee5nobody\u7684\u8eab\u4efd\u8fd0\u884c\u6765\u8fd4\u56de\u4fe1\u606f\u3002\u548c\u524d\u4e00\u4e2a\u4f8b\u5b50\u76f8\u6bd4\uff0c\u8fd9\u4e2a\u5e76\u6ca1\u6709\u989d\u5916\u7684\u4ec0\u4e48\u3002\u73b0\u5728\u6211\u4eec\u770b\u53e6\u4e00\u4e2a\u670d\u52a1 secure shellversion 1\u3002\u4e0b\u9762\u7684\u8bbe\u7f6e\u53ef\u4ee5\u9632\u6b62sshd\u6240\u5e26\u6765\u7684\u8d44\u6e90\u8017\u5c3d\u95ee\u9898\u3002<\/p>\n \u5728\u8fd9\u91cc\uff0c\u6211\u4eec\u5efa\u7acb\u4e86\u524d\u9762\u6211\u4eec\u6240\u4f5c\u7684\u3002\u5f53\u4f5c\u4e3a\u8d85\u7ea7\u7528\u6237inetd\u6216\u8005 xinetd<\/acronym>\u91cd\u65b0\u8c03\u7528sshd \u9700\u8981\u7528 -i \u53c2\u6570\uff0c \u6240\u4ee5\u6211\u4eec\u628a\u5b83\u653e\u5728\u4e86server_args\u6307\u793a\u7b26\u540e\u3002\u6ce8\u610f\uff1a\u628a\u8fd9\u4e2a\u6807\u8bb0\u6dfb\u52a0\u5230server\u6807\u8bc6\u7b26\u51fa\u4f1a\u5bfc\u81f4\u5931\u8d25\u3002\u5728\u4efb\u4f55\u65f6\u5019\u53ea\u6709\u5341\u4e2a\u4eba\u53ef\u4ee5\u540c\u65f6\u4f7f\u7528\uff0c\u5728\u8fd9\u4e2a\u670d\u52a1\u5668\u4e0a\u8fd9\u4e0d\u662f\u95ee\u9898\uff0c\u8fd9\u4e2a\u4f8b\u5b50\u6211\u4eec\u4ece\u65e5\u5fd7\u5f97 \u5230\u3002\u53e6\u5916\u4f5c\u4e3a\u9ed8\u8ba4\u4fe1\u606f\uff0c\u5982\u679c\u4e0d\u80fd\u8fde\u63a5\u7684\u8bdd\uff0c\u8fde\u63a5\u65b9\u7684\u7528\u6237 ID\u5728RFC 1413\u4e2d\u63cf\u8ff0\u3002\u6700\u540e\uff0c\u6211\u4eec\u5217\u51fa\u4e86\u4e24\u4e2a\u7f51\u7edc\u4e0d\u80fd\u8bbf\u95ee\u8fd9\u4e2a\u670d\u52a1\u3002<\/p>\n \u65e5\u5fd7\u4e2d\u6709\u51e0\u4e2a\u503c\u53ef\u4ee5\u7528\u4e8e\u5f97\u5230\u4f60\u7684\u670d\u52a1\u5668\u7684\u4fe1\u606f<\/p>\n \u8fd9\u6837\uff0c\u53ef\u4ee5\u6dfb\u52a0\u4e00\u4e9b\u6807\u51c6\u7684\u884c\u6307\u660e\u65e5\u5fd7\uff0c\u5c31\u50cf\u4e0b\u9762\u7684\u6837\u5b50\u3002\u5bf9\u4e00\u4e2a\u6210\u529f\u8fde\u63a5\u7684\u670d\u52a1\uff0c\u6211\u4eec\u901a\u5e38\u60f3\u767b\u8bb0\u670d\u52a1\u4ea7\u751f\u7684\u8fdb\u7a0bid\uff0c\u8fde\u63a5\u7684\u4e3b\u673a\u548c\u9000\u51fa\u7684\u65f6\u95f4\uff1a<\/p>\n \u8fd9\u6837\u53ef\u4ee5\u7ed9\u51fa\u6211\u4eec\u7528\u6765\u6392\u9519\u7684\u6709\u7528\u7684\u4fe1\u606f\u548c\u6b63\u5e38\u7684\u670d\u52a1\u5668\u64cd\u505a\u4fe1\u606f\u3002\u9488\u5bf9\u5931\u8d25\uff0c\u6211\u4eec\u53ef\u4ee5\u8bb0\u5f55\u6211\u4eec\u60f3\u8981\u7684\uff1a<\/p>\n \u6211\u4eec\u8bb0\u5f55\u4e86\u8fde\u63a5\u7684\u4e3b\u673a\u3001\u62d2\u7edd\u8fde\u63a5\u7684\u539f\u56e0\u548c\u5173\u4e8e\u8fde\u63a5\u4e2d\u7684\u4e3b\u673a\u7684\u989d\u5916\u7684\u4fe1\u606f(\u6709\u7684\u65f6\u5019\u662f\u90a3\u4e9b\u8bd5\u56fe\u8fde\u63a5\u7684\u7528\u6237ID)\u3002\u63a8\u8350\u4f60\u8fd9\u6837\u505a\uff0c\u53ef\u4ee5\u5bf9\u4f60\u7684\u670d\u52a1\u5668\u6709\u4e00 \u4e2a\u597d\u7684\u628a\u63e1\u3002<\/p>\n \u8fd8\u770b\u4e0a\u9762\uff0c\u5728\u6211\u4eec\u7684\u9ed8\u8ba4\u6bb5\u4e2d\uff0c\u6211\u4eec\u7684\u65e5\u5fd7\u5199\u5728\/var\/adm\/servicelog\u4e2d\u3002\u6211\u4eec\u6307\u5b9a\u6240\u6709\u4fe1\u606f\uff0c\u6210\u529f\u548c\u5931\u8d25\u7684\u90fd\u8981\u88abxinetd\u8bb0\u5f55\u3002\u6211\u4eec\u7684 \u5927\u591a\u6570\u4fe1\u606f\u770b\u8d77\u6765\u50cf\u8fd9\u6837\uff1a<\/p>\n \u4f7f\u7528\u8fd9\u4e2a\u4fe1\u606f\uff0c\u53ef\u4ee5\u8f7b\u6613\u5bf9 xinetd \u6392\u9519\u548c\u8fdb\u884c\u548c\u6b63\u5e38\u64cd\u4f5c\u3002\u4e5f\u53ef\u4ee5\u5bb9\u6613\u53d1\u73b0\u5b89\u5168\u95ee\u9898\uff08\u5982\u4f60\u8bd5\u56fe\u963b\u6b62\u7684\u8fde\u63a5\u4f01\u56fe\uff09\uff0c\u5728\u65e5\u5fd7\u4e2d\u7b80\u5355\u7684\u7528 grep\u4f5c ”FAIL” \u8fc7\u6ee4\uff0c\u8fd9\u4e9b\u9879\u663e\u793a\u5982\u4e0b\uff1a<\/p>\n \u771f\u6b63\u7684\u5b89\u5168\u95ee\u9898\u9700\u8981\u53e6\u5916\u7684\u6587\u7ae0\uff0c\u4f46\u662f\uff0c\u8fd9\u8db3\u4ee5\u8bf4\u660e\uff0c\u65e2\u7136\u5730\u5740\u53ef\u4ee5\u4f2a\u9020\uff0c\u4e0d\u8981\u628a\u5730\u5740\u62a5\u544a\u770b\u4f5c\u56fa\u5b9a\u7684\u4fe1\u606f\u3002xinetd.log\u6587\u4ef6\uff08\u5305\u542b\u4e86\u4ecexinetd\u5f97\u5230\u7684\u4fe1\u606f\uff09\u5728\u8fde\u63a5\u51fa\u9519\u7684\u65f6\u5019\u4f5c\u4e3a\u6392\u9519\u4fe1\u606f\u5f88\u6709\u7528\u3002<\/p>\n \u5728xinetd.conf\u8fd0\u884c\u7684\u65f6\u5019\uff0c\u4f60\u53ef\u4ee5\u7f16\u8f91 xinetd.conf \u6587\u4ef6\u3002\u8981\u91cd\u65b0\u914d\u7f6e\uff0c\u53d1\u9001\u4e00\u4e2a\u4fe1\u53f7SIGUSR1 \u7ed9 xinetd\u8fdb\u7a0b\uff1a<\/p>\n \u5bdf\u770b\u65e5\u5fd7\u6587\u4ef6\u7684\u5c3e\u90e8\uff08\u7528tail\u547d\u4ee4\uff09\u786e\u4fdd\u4f60\u7684\u914d\u7f6e\u548c\u6539\u52a8\u5df2\u7ecf\u751f\u6548\u3002\u5982\u679c\u4f60\u662f\u4e2a\u8fdc\u7a0b\u7528\u6237\u7684\u8bdd\u8981\u786e\u4fdd\u4f60\u9000\u51fa\u540e\u8fd8\u53ef\u4ee5\u91cd\u65b0\u767b\u9646\u8fdb\u6765\u3002 \u6ce8\u610f\u4f7f\u7528-HUP\u5bf9xinetd\u91cd\u65b0\u914d\u7f6e\uff0c\u4f1a\u5b9e\u9645\u5bfc\u81f4 xinetd<\/acronym> \u505c\u6b62\u64cd\u4f5c\u3002\u4ece\u8bbe\u8ba1\u7684\u89d2\u5ea6\u770b\uff0c\u8fd9\u53ef\u4ee5\u963b\u6b62\u9ed1\u5ba2\u91cd\u65b0\u914d\u7f6e\u4f60\u7684xinetd<\/acronym>\u5e76\u4e14\u5728\u65e0\u9700\u7406\u89e3\u6587\u6863\u7684\u60c5\u51b5\u4e0b\u5c31 \u53ef\u4ee5\u91cd\u65b0\u8f7d\u5165\u5b83\u3002<\/p>\n \u4ee5\u6211\u4e2a\u4eba\u800c\u8a00\uff0c\u5bf9\u6240\u6709\u7684\u670d\u52a1\u6211\u90fd\u4f7fxinetd<\/acronym>\uff1b \u552f\u4e00\u4e00\u4e2a\u5bf9\u6027\u80fd\u6709\u5f71\u54cd\u7684\u670d\u52a1\u662f\u6211\u7684Apache web \u5b88\u62a4\u8fdb\u7a0b\u3002\u592a\u591a\u7684\u8fdb\u7a0b\u4e0d\u5f97\u4e0d\u542f\u52a8\uff0c\u5bf9\u5b83\u6765\u8bf4\u8fd9\u592a\u5feb\u4e86\u4ece\u800c\u65f6\u95f4\u6548\u7387\u662f\u4e2a\u95ee\u9898\u3002DNS\u670d\u52a1\u4e5f\u4e0d\u5e94\u8be5\u7528 xinetd\uff0c\u6027\u80fd\u6d88\u8017\u592a\u5927\u3002<\/p>\n \u5bf9sendmail \u670d\u52a1\u6211\u4e5f\u4f7f\u7528\u4e86xinetd<\/acronym>\u3002 \u8fd9\u6837\u5bf9\u4e8e\u5141\u8bb8\u8fde\u63a5\u7684\u5ba2\u6237\uff0c\u6211\u80fd\u591f\u8fdb\u884c\u5b8c\u7f8e\u7684\u63a7\u5236\u3002\u9488\u5bf9 sendmail\u6211\u7684\u8bbe\u7f6e\u5982\u4e0b\uff1a<\/p>\n \u5373\u4f7f\u662f\u5728\u4e00\u4e2a\u9ad8\u6d41\u91cf\u7684\u90ae\u4ef6\u670d\u52a1\u5668\u4e0a\uff0c\u5bf9\u6027\u80fd\u7684\u5f71\u54cd\u4e5f\u662f\u53ef\u4ee5\u5ffd\u7565\u4e0d\u8ba1\u7684\u3002\u6211\u8fd8\u628a sshd \u8f7d\u5165\u5230 xinetd \u4ee5\u4fbf\u963b\u6b62\u5bf9\u5b83\u7684\u8fdb\u7a0b\u8868\u653b\u51fb\u3002<\/p>\n \u5e0c\u671b\u8fd9\u7bc7\u6587\u7ae0\u5bf9\u4f60\u914d\u7f6e\u6216\u662f\u6839\u636e\u9700\u8981\u8c03\u6574inetd\u80fd\u6709\u5e2e\u52a9\u3002\u6b63\u5982\u4f60\u6240\u770b\u5230\u7684\uff0c\u5b83\u63d0\u4f9b\u7684\u7279\u6027\u8981\u6bd4inetd\u5927\u5f97\u591a\uff0c\u751a\u81f3\u5305\u542b\u4e86 tcp_wrappers\u3002Solar Designer (http:\/\/www.openwall.com\/<\/a>)\u63d0\u4f9b\u4e00\u4e2a\u9488\u5bf9\u7a0d\u65e7\u4e00\u70b9\u7684xinetd<\/acronym>\u7684 \u7248\u672c\u7684\uff082.2.1\u7248\u672c\uff09\u7684\u8865\u4e01\uff0c\u5141\u8bb8\u57fa\u4e8eIP\u7684\u5b9e\u4f8b\u63a7\u5236\uff0c\u8fd9\u6709\u52a9\u4e8e\u963b\u6b62\u7b80\u5355\u7684\u8fdb\u7a0b\u8868\u653b\u51fb\u3002\u6ce8\u610f\uff0c\u4e0d\u7ba1\u600e\u6837\uff0c\u7b80\u5355\u7684\u4f2a\u9020\u53ef\u4ee5\u7ed5\u8fc7\u5b83\u3002\u6211\u4e0d\u77e5\u9053\u662f\u5426\u8fd9\u4e2a\u5305\u5bf9 \u4ee5\u540e\u7684 xinetd<\/acronym>\u662f \u5426\u4e5f\u9002\u7528\u3002<\/p>\n \u9644\uff1axinetd \u4ee3\u8868 Extended Internet Services Daemon\u4e0b\u9762\u9644\u4e0a\u4e00\u4e2axinetd.conf\u624b\u518c\u9875\u4e0a\u7684\u53c2\u8003\u8bbe\u7f6e\uff1a<\/p>\n \u7ffb\u8bd1\u540e\u8bb0\uff1a\u4e00\u65e5\u5728\u7f51\u4e0a\u770b\u5230\u81ea\u5df1\u57282\u5e74\u524d\u7684\u8fd9\u4e2a\u7ffb\u8bd1\u6587\u6863\uff0c\u7ec6\u8bfb\u4e00\u4e0b\uff0c\u53d1\u73b0\u8c2c\u8bef\u4e0d\u5c11\uff0c\u9042\u627e\u5230\u539f\u6587\uff0c\u66f4\u6b63\u4e86\u4e00\u4e9b\u4e0d\u5f53\u4e4b\u5904\u3002\u7ffb\u8bd1\u4e0d\u5f53\u4e4b\u5904\u80af\u5b9a\u8fd8\u662f\u5b58\u5728\u7684\uff0c\u6b22\u8fce\u6307 \u51fa!<\/p>\n <\/p>\n <\/p>\n xinetd<\/a> – http:\/\/www.xinetd.org\/<\/p>\n\u5bfc\u8a00<\/h2>\n
\n
xinetd\/internals.c.orig
Fri Jun 16 19:00:15 2000
+++ xinetd\/internals.c
Fri Jun 16 19:00:53 2000
@@ -12,6 +12,8 @@
#include <time.h>
#include <fcntl.h>
#include <syslog.h>
#include <unistd.h>
#include <sys\/time.h>
#include "sio.h"<\/pre>\n<\/blockquote>\n\u5173\u4e8e xinetd<\/h2>\n
\n
\/usr\/sbin\/xinetd -filelog \/var\/adm\/xinetd.log -f \/etc\/xinetd.conf<\/pre>\n<\/blockquote>\n
\u7f16\u8bd1\u65f6\u9009\u9879<\/h2>\n
\u914d\u7f6e\u6587\u4ef6<\/h2>\n
\n
$ itox < \/etc\/inetd.conf > xinetd.conf<\/pre>\n<\/blockquote>\n
\n
defaults
{
instances= 25
log_type= FILE \/var\/adm\/servicelog
log_on_success= PID HOST EXIT
flags= NORETRY
log_on_failure= HOST RECORD ATTEMPT
only_from= 129.22.0.0
no_access= 129.22.210.61
disabled= nntp uucp tftp bootps who
shell login exec
disabled+= finger
}<\/pre>\n<\/blockquote>\n\n
\n\n
\n \u8868 1. xinetd\u7684\u6307\u793a\u7b26<\/strong><\/td>\n<\/tr>\n \n \u6307\u793a\u7b26<\/td>\n \u63cf\u8ff0<\/td>\n<\/tr>\n \n socket_type<\/td>\n \u7f51\u7edc\u5957\u63a5\u5b57\u7c7b\u578b, \u6d41\u6216\u8005\u6570\u636e\u5305<\/td>\n<\/tr>\n \n socket_type<\/td>\n \u7f51\u7edc\u5957\u63a5\u5b57\u7c7b\u578b, \u6d41\u6216\u8005\u6570\u636e\u5305<\/td>\n<\/tr>\n \n protocol<\/td>\n IP \u534f\u8bae, \u901a\u5e38\u662fTCP\u6216\u8005 UDP<\/td>\n<\/tr>\n \n wait<\/td>\n yes\/no, \u7b49\u540c\u4e8einetd\u7684wait\/nowait<\/td>\n<\/tr>\n \n user<\/td>\n \u8fd0\u884c\u8fdb\u7a0b\u7684\u7528\u6237 ID<\/td>\n<\/tr>\n \n server<\/td>\n \u6267\u884c\u7684\u5b8c\u6574\u8def\u5f84<\/td>\n<\/tr>\n \n server_args<\/td>\n \u4f20\u9012\u7ed9server\u7684\u53d8\u91cf,\u6216\u8005\u662f\u503c<\/td>\n<\/tr>\n \n instances<\/td>\n \u53ef\u4ee5\u542f\u52a8\u7684\u5b9e\u4f8b\u7684\u6700\u5927\u7684\u503c<\/td>\n<\/tr>\n \n start max_load<\/td>\n \u8d1f\u8f7d\u5747\u8861<\/td>\n<\/tr>\n \n log_on_success<\/td>\n \u6210\u529f\u542f\u52a8\u7684\u767b\u8bb0\u9009\u9879<\/td>\n<\/tr>\n \n log_on_failure<\/td>\n \u8054\u673a\u5931\u8d25\u7684\u65f6\u5019\u7684\u65e5\u5fd7\u4fe1\u606f<\/td>\n<\/tr>\n \n only_from<\/td>\n \u63a5\u53d7\u7684\u7f51\u7edc\u6216\u662f\u4e3b\u673a<\/td>\n<\/tr>\n \n no_access<\/td>\n \u62d2\u7edd\u8bbf\u95ee\u7684\u7f51\u7edc\u6216\u662f\u4e3b\u673a<\/td>\n<\/tr>\n \n disabled<\/td>\n \u7528\u5728\u9ed8\u8ba4\u7684 {} \u4e2d \u7981\u6b62\u670d\u52a1<\/td>\n<\/tr>\n \n log_type<\/td>\n \u65e5\u5fd7\u7684\u7c7b\u578b\u548c\u8def\u5f84 FILE \/SYSLOG<\/td>\n<\/tr>\n \n nice<\/td>\n \u8fd0\u884c\u670d\u52a1\u7684\u4f18\u5148\u7ea7<\/td>\n<\/tr>\n \n id<\/td>\n \u65e5\u5fd7\u4e2d\u4f7f\u7528\u7684\u670d\u52a1\u540d<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/blockquote>\n
{
\u6307\u793a\u7b26 = \u503c
\u6307\u793a\u7b26 += \u503c
}<\/p>\n\u5173\u4e8e\u8bbf\u95ee\u63a7\u5236<\/h2>\n
\u670d\u52a1\u914d\u7f6e<\/h2>\n
\n
service echo
{
socket_type= stream
protocol= tcp
wait= no
user= root
type= INTERNAL
id= echo-stream
}<\/pre>\n<\/blockquote>\n\n
service daytime
{
socket_type= stream
protocol= tcp
wait= no
user= nobody
server= \/usr\/sbin\/in.date
instances= 1
nice= 10
only_from= 0.0.0.0
}<\/pre>\n<\/blockquote>\n\n
service ssh1
{
socket_type= stream
protocol= tcp
instances= 10
nice= 10
wait= no
user= root
server= \/usr\/local\/sbin\/sshd1
server_args= -i
log_on_failure+= USERID
only_from= 192.168.0.0
no_access= 192.168.54.0
no_access+= 192.168.33.0
}<\/pre>\n<\/blockquote>\n\u65e5\u5fd7\u548c xinetd<\/h2>\n
\n
\n\n
\n \u88682 \u4e0d\u540c\u7684\u65e5\u5fd7\u6307\u793a\u503c<\/strong><\/td>\n<\/tr>\n \n \u503c<\/td>\n \u6210\u529f\/\u5931\u8d25<\/td>\n \u63cf\u8ff0<\/td>\n<\/tr>\n \n PID<\/td>\n success<\/td>\n \u5f53\u4e00\u4e2a\u8fde\u63a5\u6210\u529f\u65f6\u767b\u8bb0\u4ea7\u751f\u7684\u8fdb\u7a0b\u7684pid<\/td>\n<\/tr>\n \n HOST<\/td>\n both<\/td>\n \u767b\u8bb0\u8fdc\u7a0b\u4e3b\u673a\u5730\u5740<\/td>\n<\/tr>\n \n USERID<\/td>\n both<\/td>\n \u767b\u8bb0\u8fdc\u7a0b\u7528\u6237\u7684RFC 1413 ID<\/td>\n<\/tr>\n \n EXIT<\/td>\n success<\/td>\n \u767b\u8bb0\u4ea7\u751f\u7684\u8fdb\u7a0b\u7684\u5b8c\u6210<\/td>\n<\/tr>\n \n DURATION<\/td>\n success<\/td>\n \u767b\u8bb0\u4efb\u52a1\u6301\u7eed\u7684\u65f6\u95f4<\/td>\n<\/tr>\n \n ATTEMPT<\/td>\n failure<\/td>\n \u767b\u8bb0\u8fde\u63a5\u5931\u8d25\u7684\u539f\u56e0<\/td>\n<\/tr>\n \n RECORD<\/td>\n failure<\/td>\n \u5173\u4e8e\u8fde\u63a5\u5931\u8d25\u7684\u989d\u5916\u7684\u4fe1\u606f<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/blockquote>\n \n
log_on_success = PID HOST EXIT<\/pre>\n<\/blockquote>\n
\n
log_on_failure = HOST RECORD ATTEMPT<\/pre>\n<\/blockquote>\n
\n
00\/9\/13@16:05:07: START: pop3 pid=25679 from=192.168.152.133
00\/9\/13@16:05:09: EXIT: pop3 status=0 pid=25679
00\/10\/3@19:28:18: USERID: telnet OTHER :www<\/pre>\n<\/blockquote>\n\n
00\/10\/4@17:04:58: FAIL: telnet address from=216.237.57.154
00\/10\/8@22:25:09: FAIL: pop2 address from=202.112.14.184<\/pre>\n<\/blockquote>\n\n
00\/10\/25@21:10:48 xinetd[50]: ERROR: service echo-stream,
accept:
Connection reset by peer<\/pre>\n<\/blockquote>\n\u91cd\u914d\u7f6e xinetd<\/h2>\n
\n
# ps -ax | grep xinetd
50 ? S 5:47 \/usr\/sbin\/xinetd -filelog \/var\/adm\/xinetd.log -f \/etc\/xinetd.conf
# kill -SIGUSR1 50<\/pre>\n<\/blockquote>\n\u4f55\u65f6\u4f7f\u7528xinetd<\/h2>\n
\n
service smtp
{
socket_type= stream
protocol= tcp
wait= no
user= root
server= \/usr\/sbin\/sendmail
server_args= -bs
instances= 20
nice= 10
only_from+= 0.0.0.0
no_access+= 129.22.122.84 204.0.224.254
}<\/pre>\n<\/blockquote>\n\u7ed3\u8bba<\/h2>\n
\n
#
# Sample configuration file for xinetd
#
defaults
{
log_type= FILE \/var\/log\/servicelog
log_on_success= PID
log_on_failure= HOST RECORD
only_from= 128.138.193.0 128.138.204.0
only_from= 128.138.252.1
instances= 10
disabled= rstatd
}
#
# Note 1: the protocol attribute is not required
# Note 2: the instances attribute overrides the default
#
service login
{
socket_type= stream
protocol= tcp
wait= no
user= root
server= \/usr\/etc\/in.rlogind
instances= UNLIMITED
}
#
# Note 1: the instances attribute overrides the default
# Note 2: the log_on_success flags are augmented
#
service shell
{
socket_type= stream
wait= no
user= root
instances= UNLIMITED
server= \/usr\/etc\/in.rshd
log_on_success+= HOST RECORD
}
service ftp
{
socket_type= stream
wait= no
nice= 10
user= root
server= \/usr\/etc\/in.ftpd
server_args= -l
instances= 4
log_on_success+= DURATION HOST USERID
access_times= 2:00-9:00 12:00-24:00
}
# Limit telnet sessions to 8 Mbytes of memory and a total
# 20 CPU seconds for child processes.
service telnet
{
socket_type= stream
wait= no
nice= 10
user= root
server= \/usr\/etc\/in.telnetd
rlimit_as= 8M
rlimit_cpu= 20
}
#
# This entry and the next one specify internal services. Since
# this is the same service using a different socket type, the
# id attribute is used to uniquely identify each entry
#
service echo
{
id= echo-stream
type= INTERNAL
socket_type= stream
user= root
wait= no
}
service echo
{
id= echo-dgram
type= INTERNAL
socket_type= dgram
user= root
wait= no
}
service servers
{
type= INTERNAL UNLISTED
protocol= tcp
port= 9099
socket_type= stream
wait= no
}
#
# Sample RPC service
#
service rstatd
{
type= RPC
socket_type= dgram
protocol= udp
server= \/usr\/etc\/rpc.rstatd
wait= yes
user= root
rpc_version= 2-4
env= LD_LIBRARY_PATH=\/etc\/securelib
}
#
# Sample unlisted service
#
service unlisted
{
type= UNLISTED
socket_type= stream
protocol= tcp
wait= no
server= \/home\/user\/some_server
port= 20020
}<\/pre>\n<\/blockquote>\n\u53c2\u8003\u4fe1\u606f(\u8bd1\u8005\u63d0\u4f9b)<\/h2>\n