NAME
netacl - TCP network access control
SYNOPSIS
netacl servicename [invoked from inetd]
DESCRIPTION
netacl provides a degree of access control for TCP-based services invoked from inetd(8). When a server is started, inetd invokes netacl with the name of the service requested, instead of the actual server. netacl then searches its permissions information (read from netperm-table ) to see if the host initiating the connection is authorized. If the host is authorized, the real server process is invoked. Otherwise, netacl exits. Acceptance or rejection of the service is logged via the syslog facility.
netacl duplicates functionality found in other tools such as log_tcp by Wietse Venema, but is included with the toolkit because it is a simpler implementation, contains no support for UDP services, and shares a common configuration file with the rest of the toolkit components.
OPTIONS
netacl takes one parameter: the name of the service it is to provide. This service name is appended to the string "netacl-" to generate the name by which rules are read from the netperm-table configuration file. If invoked with no parameters, the service is assumed to be the program name - in case one needs to replace the executable of some daemon with a copy of netacl. For example, if netacl is invoked as:
netacl in.telnetd
it will retrieve all the configuration rules for netacl-in.telnetd.
The following configuration rules are recognized:
- hosts [options]
-
specifies a host permission rule. Host permission rules are in the form of:
netacl-in.telnet permit-hosts host1 host2 -options netacl-in.telnet deny-hosts host1 host2 -options
Following the permit-hosts or deny-hosts clause is a list of host names or IP-addresses, which can contain wildcards. Host names are searched in order until the first option (starting with a '-') is encountered, at which point, if there is a match for that rule, it will be accepted. If the rule is a deny-hosts rule, the program will log the denial of service and exit. If it is a permit-hosts rule, the options will be processed and executed in order. If there is no rule explicitly permitting or deny a service, the service is denied. Options are:
-
-exec executable [args] specifies a program to invoke to handle the service. This option must be the final option in the rule. A -exec option must be present in every rule.
-
-user userid where userid is the numeric UID or the name from a login in /etc/passwd which the program should be invoked as.
-
-chroot rootdir specifies a directory to which netacl should chroot(2) prior to invoking the service program. This requires that the service program be present, and the pathname for the executable be relative to the new root.
EXAMPLES
In this example, the \ line wraps have been added to fit lines on the page. \-escapes are not permitted in netperm-table, they are here as part of the example only
netacl-in.telnetd: permit-hosts 192.33.112.* \
-exec /usr/etc/in.telnetd
netacl-in.ftpd: permit-hosts unknown \
-exec /bin/cat /usr/local/etc/noftp.txt
netacl-in.ftpd: permit-hosts 192.33.112.* \
-exec /usr/etc/in.ftpd
netacl-in.ftpd: permit-hosts * -chroot /home/ftp \
-exec /bin/ftpd -f
In the example above, netacl is configured to permit telnet only for hosts in a particular subnet. ftpd is configured to accept all connections from systems that do not have a valid DNS name ("unknown") and to invoke cat to display a file when a connection is made. This provides an easy and flexible means of politely informing someone that they are not permitted to use a service. Hosts in the specified subnet are connected to the real FTP server in /usr/etc/in.ftpd but all connections from other networks are connected to a version of the FTP server that is already chrooted to the FTP area, effectively making all FTP activity "captive".
INSTALLATION
To install netacl first place the executable in a system area, then modify /etc/inetd.conf as desired, replacing entries for the servers that will be controlled via netacl. For example (syntax may differ slightly depending on O/S version) the FTP service might be configured as:
ftp stream tcp nowait root /usr/local/etc/netacl in.ftpd
Once inetd.conf has been modified, restart or reload inetd. Verify installation by attempting a connection, and monitoring the system logs.
FILES
- /etc/inetd.conf
-
netperm-table