And&nbsp;here&nbsp;is&nbsp;the&nbsp;same&nbsp;record&nbsp;after&nbsp;modification&nbsp;to&nbsp;support&nbsp;TCP&nbsp;Wrappers:&nbsp;<BR>telnet&nbsp;stream&nbsp;tcp&nbsp;nowait&nbsp;root&nbsp;/sbin/tcpd&nbsp;/sbin/in.telnetd&nbsp;<BR>Remember&nbsp;after&nbsp;editing&nbsp;this&nbsp;file&nbsp;to&nbsp;tell&nbsp;inetd&nbsp;to&nbsp;re-read&nbsp;it&nbsp;with&nbsp;kill&nbsp;-1.&nbsp;<BR>Configuration&nbsp;<BR>Access&nbsp;Control&nbsp;<BR>The&nbsp;core&nbsp;idea&nbsp;behind&nbsp;TCP&nbsp;Wrappers&nbsp;is&nbsp;that&nbsp;of&nbsp;an&nbsp;access-control&nbsp;policy.&nbsp;The&nbsp;&nbsp;<BR>policy&nbsp;rules&nbsp;are&nbsp;held&nbsp;in&nbsp;two&nbsp;files:&nbsp;/etc/hosts.allow&nbsp;and&nbsp;/etc/hosts.deny.&nbsp;&nbsp;<BR>These&nbsp;are&nbsp;the&nbsp;default&nbsp;pathnames,&nbsp;which&nbsp;can&nbsp;be&nbsp;changed&nbsp;in&nbsp;the&nbsp;Makefile.&nbsp;<BR>Access&nbsp;can&nbsp;be&nbsp;controlled&nbsp;per&nbsp;host,&nbsp;per&nbsp;service,&nbsp;or&nbsp;in&nbsp;combinations&nbsp;thereof.&nbsp;&nbsp;<BR>Access&nbsp;control&nbsp;also&nbsp;can&nbsp;be&nbsp;used&nbsp;to&nbsp;connect&nbsp;clients&nbsp;to&nbsp;particular&nbsp;services,&nbsp;&nbsp;<BR>depending&nbsp;on&nbsp;the&nbsp;requested&nbsp;service,&nbsp;the&nbsp;origin&nbsp;of&nbsp;the&nbsp;request,&nbsp;and&nbsp;to&nbsp;what&nbsp;&nbsp;<BR>host&nbsp;address&nbsp;the&nbsp;client&nbsp;&nbsp;<BR>connects.&nbsp;For&nbsp;example,&nbsp;a&nbsp;www&nbsp;daemon&nbsp;might&nbsp;serve&nbsp;documents&nbsp;in&nbsp;the&nbsp;native&nbsp;&nbsp;<BR>language&nbsp;when&nbsp;contacted&nbsp;from&nbsp;within&nbsp;the&nbsp;same&nbsp;country,&nbsp;but&nbsp;default&nbsp;to&nbsp;English&nbsp;&nbsp;<BR>otherwise.&nbsp;<BR>The&nbsp;format&nbsp;of&nbsp;these&nbsp;files&nbsp;is&nbsp;described&nbsp;in&nbsp;detail&nbsp;by&nbsp;hosts_access(5).&nbsp;Each&nbsp;&nbsp;<BR>file&nbsp;consists&nbsp;of&nbsp;a&nbsp;set&nbsp;of&nbsp;rules&nbsp;that&nbsp;are&nbsp;searched&nbsp;first&nbsp;in&nbsp;hosts.allow,&nbsp;then&nbsp;&nbsp;<BR>in&nbsp;hosts.deny.&nbsp;The&nbsp;search&nbsp;stops&nbsp;at&nbsp;the&nbsp;first&nbsp;match,&nbsp;so&nbsp;if&nbsp;a&nbsp;host&nbsp;is&nbsp;granted&nbsp;&nbsp;<BR>access&nbsp;in&nbsp;hosts.allow,&nbsp;it&nbsp;&nbsp;<BR>doesn't&nbsp;matter&nbsp;if&nbsp;it&nbsp;is&nbsp;blocked&nbsp;in&nbsp;hosts.deny.&nbsp;<BR>There&nbsp;are&nbsp;two&nbsp;basic&nbsp;keywords,&nbsp;&quot;allow&quot;&nbsp;and&nbsp;&quot;deny.&quot;&nbsp;These&nbsp;are&nbsp;used&nbsp;in&nbsp;&nbsp;<BR>conjunction&nbsp;with&nbsp;specific&nbsp;hostnames,&nbsp;or&nbsp;a&nbsp;wildcard&nbsp;from&nbsp;the&nbsp;following&nbsp;list:&nbsp;<BR>A&nbsp;string&nbsp;beginning&nbsp;with&nbsp;&quot;.&quot;&nbsp;matches&nbsp;all&nbsp;hostnames&nbsp;that&nbsp;conclude&nbsp;with&nbsp;that&nbsp;&nbsp;<BR>string.&nbsp;For&nbsp;example,&nbsp;.example.com&nbsp;would&nbsp;match&nbsp;dunne.example.com.&nbsp;<BR>A&nbsp;string&nbsp;ending&nbsp;with&nbsp;&quot;.&quot;&nbsp;matches&nbsp;all&nbsp;hosts&nbsp;whose&nbsp;IP&nbsp;addresses&nbsp;begin&nbsp;with&nbsp;that&nbsp;&nbsp;<BR>sequence.&nbsp;For&nbsp;example,&nbsp;192.168.&nbsp;would&nbsp;match&nbsp;all&nbsp;addresses&nbsp;in&nbsp;the&nbsp;range&nbsp;&nbsp;<BR>192.168.xxx.xxx.&nbsp;<BR>A&nbsp;string&nbsp;beginning&nbsp;with&nbsp;&quot;@&quot;&nbsp;is&nbsp;treated&nbsp;as&nbsp;an&nbsp;NIS&nbsp;netgroup&nbsp;name.&nbsp;<BR>A&nbsp;string&nbsp;of&nbsp;the&nbsp;form&nbsp;n.n.n.n/m.m.m.m&nbsp;is&nbsp;treated&nbsp;as&nbsp;a&nbsp;network/mask&nbsp;pair.&nbsp;<BR>There&nbsp;also&nbsp;are&nbsp;some&nbsp;special&nbsp;shorthand&nbsp;names:&nbsp;<BR>ALL&nbsp;<BR>Always&nbsp;matches.&nbsp;<BR>LOCAL&nbsp;<BR>Matches&nbsp;any&nbsp;host&nbsp;whose&nbsp;name&nbsp;does&nbsp;not&nbsp;contain&nbsp;a&nbsp;dot&nbsp;character.&nbsp;<BR>UNKNOWN&nbsp;<BR>Matches&nbsp;a&nbsp;user&nbsp;whose&nbsp;name&nbsp;is&nbsp;unknown,&nbsp;and&nbsp;matches&nbsp;any&nbsp;host&nbsp;whose&nbsp;name&nbsp;or&nbsp;&nbsp;<BR>address&nbsp;are&nbsp;unknown.&nbsp;<BR>KNOWN&nbsp;<BR>Matches&nbsp;a&nbsp;user&nbsp;whose&nbsp;name&nbsp;is&nbsp;known,&nbsp;and&nbsp;matches&nbsp;any&nbsp;host&nbsp;whose&nbsp;name&nbsp;and&nbsp;&nbsp;<BR>address&nbsp;is&nbsp;known.&nbsp;<BR>PARANOID&nbsp;<BR>Matches&nbsp;any&nbsp;host&nbsp;whose&nbsp;name&nbsp;does&nbsp;not&nbsp;match&nbsp;its&nbsp;address.&nbsp;<BR>There&nbsp;also&nbsp;is&nbsp;a&nbsp;set&nbsp;of&nbsp;symbolic&nbsp;names&nbsp;that&nbsp;expand&nbsp;to&nbsp;various&nbsp;information&nbsp;&nbsp;<BR>about&nbsp;the&nbsp;client&nbsp;and&nbsp;server.&nbsp;The&nbsp;full&nbsp;list&nbsp;of&nbsp;such&nbsp;expansions&nbsp;is:&nbsp;<BR>%a&nbsp;<BR>the&nbsp;client&nbsp;IP&nbsp;address&nbsp;<BR>%c&nbsp;<BR>client&nbsp;information:&nbsp;user@host,&nbsp;user@&nbsp;<BR>%d&nbsp;<BR>argv[0]&nbsp;from&nbsp;the&nbsp;daemon&nbsp;process&nbsp;<BR>%h&nbsp;<BR>client&nbsp;hostname&nbsp;or&nbsp;IP&nbsp;address&nbsp;<BR>%n&nbsp;<BR>client&nbsp;hostname&nbsp;<BR>%p&nbsp;<BR>process&nbsp;id&nbsp;of&nbsp;the&nbsp;daemon&nbsp;<BR>%s&nbsp;<BR>server&nbsp;information&nbsp;<BR>%u&nbsp;<BR>client&nbsp;username&nbsp;<BR>%%&nbsp;<BR>literal&nbsp;&quot;%&quot;&nbsp;<BR>Examples&nbsp;<BR>There&nbsp;are&nbsp;several&nbsp;typical&nbsp;forms&nbsp;of&nbsp;access&nbsp;control&nbsp;that&nbsp;provide&nbsp;examples&nbsp;of&nbsp;&nbsp;<BR>using&nbsp;the&nbsp;access&nbsp;control&nbsp;files.&nbsp;note&nbsp;that&nbsp;explicitly-authorized&nbsp;hosts&nbsp;are&nbsp;&nbsp;<BR>listed&nbsp;in&nbsp;hosts.allow;&nbsp;most&nbsp;other&nbsp;rules&nbsp;are&nbsp;put&nbsp;in&nbsp;hosts.deny.&nbsp;<BR>To&nbsp;deny&nbsp;all&nbsp;access,&nbsp;leave&nbsp;hosts.allow&nbsp;blank,&nbsp;and&nbsp;put&nbsp;this&nbsp;in&nbsp;hosts.deny:&nbsp;<BR>ALL:&nbsp;ALL&nbsp;<BR>To&nbsp;allow&nbsp;all&nbsp;access,&nbsp;simply&nbsp;leave&nbsp;both&nbsp;files&nbsp;blank.&nbsp;<BR>To&nbsp;allow&nbsp;controlled&nbsp;access,&nbsp;add&nbsp;rules&nbsp;to&nbsp;hosts.allow&nbsp;and&nbsp;hosts.deny&nbsp;as&nbsp;&nbsp;<BR>appropriate.&nbsp;At&nbsp;it's&nbsp;simplest,&nbsp;this&nbsp;involves&nbsp;listing&nbsp;banned&nbsp;sites&nbsp;in&nbsp;&nbsp;<BR>hosts.deny:&nbsp;<BR>evilcrackers.com:&nbsp;ALL&nbsp;<BR>On&nbsp;the&nbsp;other&nbsp;hand,&nbsp;you&nbsp;can&nbsp;also&nbsp;deny&nbsp;access&nbsp;to&nbsp;all&nbsp;save&nbsp;selected&nbsp;sites:&nbsp;<BR>/etc/hosts.allow:&nbsp;<BR>example.com:ALL&nbsp;<BR>/etc/hosts.deny:&nbsp;<BR>ALL:ALL&nbsp;<BR>Remember,&nbsp;the&nbsp;first&nbsp;match&nbsp;is&nbsp;the&nbsp;one&nbsp;that&nbsp;counts&nbsp;--&nbsp;the&nbsp;&quot;ALL&quot;&nbsp;in&nbsp;hosts.deny&nbsp;&nbsp;<BR>won't&nbsp;block&nbsp;example.com.&nbsp;<BR>Booby&nbsp;Traps&nbsp;<BR>A&nbsp;useful&nbsp;feature&nbsp;is&nbsp;the&nbsp;ability&nbsp;to&nbsp;trigger&nbsp;actions&nbsp;on&nbsp;the&nbsp;host&nbsp;based&nbsp;on&nbsp;&nbsp;<BR>attempted&nbsp;connections.&nbsp;For&nbsp;example,&nbsp;if&nbsp;we&nbsp;detect&nbsp;a&nbsp;remote&nbsp;site&nbsp;attempting&nbsp;to&nbsp;&nbsp;<BR>use&nbsp;our&nbsp;tftp&nbsp;server,&nbsp;the&nbsp;following&nbsp;rule&nbsp;in&nbsp;/etc/hosts.deny&nbsp;not&nbsp;only&nbsp;rejects&nbsp;&nbsp;<BR>the&nbsp;attempt,&nbsp;but&nbsp;notifies&nbsp;&nbsp;<BR>the&nbsp;system&nbsp;administrator:&nbsp;<BR>in.tftpd:&nbsp;ALL:&nbsp;spawn&nbsp;finger&nbsp;-l&nbsp;@%h&nbsp;2&gt;&amp;1&nbsp;|&nbsp;mail&nbsp;-s&nbsp;&quot;remote&nbsp;tftp&nbsp;attempt&quot;&nbsp;sysadm&nbsp;<BR>The&nbsp;use&nbsp;of&nbsp;this&nbsp;feature&nbsp;relies&nbsp;on&nbsp;the&nbsp;PROCESS_OPTIONS&nbsp;option.&nbsp;This&nbsp;option&nbsp;&nbsp;<BR>also&nbsp;provides&nbsp;some&nbsp;other&nbsp;useful&nbsp;features.&nbsp;<BR>spawn&nbsp;&lt;shell_command&gt;&nbsp;<BR>Runs&nbsp;the&nbsp;specified&nbsp;shell&nbsp;command&nbsp;as&nbsp;a&nbsp;child&nbsp;process.&nbsp;<BR>twist&nbsp;&lt;shell_command&gt;&nbsp;<BR>Replaces&nbsp;the&nbsp;current&nbsp;process&nbsp;by&nbsp;the&nbsp;specified&nbsp;shell&nbsp;command.&nbsp;<BR>banners&nbsp;&lt;pathname&gt;&nbsp;<BR>Copies&nbsp;the&nbsp;contents&nbsp;of&nbsp;the&nbsp;file&nbsp;in&nbsp;&lt;pathname&gt;&nbsp;to&nbsp;the&nbsp;client.&nbsp;Useful&nbsp;for&nbsp;sites&nbsp;&nbsp;<BR>that&nbsp;are&nbsp;required&nbsp;to&nbsp;display&nbsp;a&nbsp;site&nbsp;policy&nbsp;banner&nbsp;to&nbsp;all&nbsp;users.&nbsp;<BR>See&nbsp;the&nbsp;host_options(5)&nbsp;man&nbsp;page&nbsp;for&nbsp;full&nbsp;details&nbsp;of&nbsp;these&nbsp;and&nbsp;other&nbsp;options.&nbsp;<BR>Logging&nbsp;<BR>Log&nbsp;records&nbsp;are&nbsp;written&nbsp;to&nbsp;the&nbsp;syslog&nbsp;daemon,&nbsp;syslogd,&nbsp;with&nbsp;facility&nbsp;and&nbsp;&nbsp;<BR>level&nbsp;as&nbsp;specified&nbsp;in&nbsp;the&nbsp;Makefile&nbsp;at&nbsp;compile&nbsp;time.&nbsp;What&nbsp;happens&nbsp;to&nbsp;them&nbsp;&nbsp;<BR>there&nbsp;is&nbsp;determined&nbsp;by&nbsp;the&nbsp;syslogd&nbsp;config&nbsp;file&nbsp;/etc/syslog.conf.&nbsp;If&nbsp;&nbsp;<BR>PROCESS_OPTIONS&nbsp;has&nbsp;been&nbsp;defined,&nbsp;the&nbsp;&nbsp;<BR>facility&nbsp;and&nbsp;level&nbsp;can&nbsp;be&nbsp;changed&nbsp;at&nbsp;run&nbsp;time&nbsp;by&nbsp;using&nbsp;the&nbsp;keyword&nbsp;&nbsp;<BR>&quot;severity,&quot;&nbsp;for&nbsp;example,&nbsp;<BR>severity&nbsp;mail.info&nbsp;<BR>specifies&nbsp;a&nbsp;facility&nbsp;&quot;mail,&quot;&nbsp;level&nbsp;&quot;info.&quot;&nbsp;An&nbsp;undotted&nbsp;argument&nbsp;is&nbsp;understood&nbsp;&nbsp;<BR>as&nbsp;a&nbsp;level.&nbsp;<BR>Resources&nbsp;<BR>In&nbsp;addition&nbsp;to&nbsp;the&nbsp;thorough&nbsp;set&nbsp;of&nbsp;man&nbsp;pages&nbsp;that&nbsp;comes&nbsp;with&nbsp;the&nbsp;software,&nbsp;&nbsp;<BR>Venema's&nbsp;paper,&nbsp;&quot;TCP&nbsp;WRAPPER:&nbsp;Network&nbsp;monitoring,&nbsp;access&nbsp;control,&nbsp;and&nbsp;booby&nbsp;&nbsp;<BR>traps,&quot;&nbsp;is&nbsp;a&nbsp;useful&nbsp;account&nbsp;of&nbsp;the&nbsp;thinking&nbsp;that&nbsp;led&nbsp;to&nbsp;the&nbsp;creation&nbsp;of&nbsp;the&nbsp;&nbsp;<BR>software.&nbsp;It&nbsp;is&nbsp;available&nbsp;&nbsp;<BR>at&nbsp;<A HREF="ftp://ftp.porcupine.org/pub/security/">ftp://ftp.porcupine.org/pub/security/</A>&nbsp;in&nbsp;ASCII&nbsp;text&nbsp;and&nbsp;PostScript&nbsp;--&nbsp;look&nbsp;&nbsp;<BR>for&nbsp;tcp_wrapper.&lt;format&gt;.Z.&nbsp;<BR>Conclusion&nbsp;<BR>TCP&nbsp;Wrappers&nbsp;protects&nbsp;against&nbsp;many&nbsp;common&nbsp;attempts&nbsp;to&nbsp;compromise&nbsp;a&nbsp;UNIX&nbsp;&nbsp;<BR>machine&nbsp;connected&nbsp;to&nbsp;the&nbsp;Internet.&nbsp;TCP&nbsp;Wrappers&nbsp;is&nbsp;easy&nbsp;to&nbsp;use:&nbsp;there&nbsp;is&nbsp;no&nbsp;&nbsp;<BR>need&nbsp;to&nbsp;modify&nbsp;existing&nbsp;software,&nbsp;only&nbsp;simple&nbsp;(and&nbsp;optional)&nbsp;changes&nbsp;to&nbsp;one&nbsp;&nbsp;<BR>existing&nbsp;configuration&nbsp;file&nbsp;&nbsp;<BR>are&nbsp;necessary,&nbsp;and&nbsp;there&nbsp;is&nbsp;no&nbsp;impact&nbsp;on&nbsp;genuine&nbsp;users.&nbsp;For&nbsp;your&nbsp;efforts,&nbsp;you&nbsp;&nbsp;<BR>get&nbsp;protection&nbsp;against&nbsp;a&nbsp;variety&nbsp;of&nbsp;cracking&nbsp;techniques&nbsp;and&nbsp;the&nbsp;ability&nbsp;to&nbsp;&nbsp;<BR>install&nbsp;trip&nbsp;wires&nbsp;to&nbsp;notify&nbsp;you&nbsp;of&nbsp;attempted&nbsp;break-ins.&nbsp;It's&nbsp;easy&nbsp;to&nbsp;see&nbsp;why&nbsp;&nbsp;<BR>millions&nbsp;of&nbsp;systems&nbsp;&nbsp;<BR>worldwide&nbsp;have&nbsp;installed&nbsp;this&nbsp;valuable&nbsp;tool.&nbsp;<BR>Paul&nbsp;Dunne&nbsp;(<A HREF="http://dunne.home.dhs.org)">http://dunne.home.dhs.org)</A>&nbsp;is&nbsp;a&nbsp;writer&nbsp;and&nbsp;consultant&nbsp;&nbsp;<BR>specializing&nbsp;in&nbsp;Linux..&nbsp;&nbsp;<BR>--&nbsp;<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;^\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.....&nbsp;&nbsp;(&nbsp;^&nbsp;)&nbsp;&nbsp;.....&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/^&nbsp;<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;^-^&nbsp;^^^^^^&nbsp;{&nbsp;0&nbsp;0&nbsp;}&nbsp;^^^^^^&nbsp;^-^&nbsp;<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;^&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;^^&nbsp;(&nbsp;@&nbsp;)&nbsp;^^&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;^&nbsp;<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;&nbsp;<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;I&nbsp;am&nbsp;back&nbsp;from&nbsp;hell&nbsp;<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Tears&nbsp;still&nbsp;leave&nbsp;in&nbsp;heaven&nbsp;<BR>&nbsp;<BR>※&nbsp;修改:·CuteGuy&nbsp;於&nbsp;May&nbsp;&nbsp;2&nbsp;12:34:46&nbsp;修改本文·[FROM:&nbsp;rock.cs.uestc.e]&nbsp;<BR>※&nbsp;來源:·BBS&nbsp;水木清華站&nbsp;bbs.net.tsinghua.edu.cn·[FROM:&nbsp;rock.cs.uestc.e]&nbsp;<BR><CENTER><H1>BBS水木清華站∶精華區(qū)</H1></CENTER></BODY></HTML>