HOSTS_ACCESS

NAME

DESCRIPTION

¥¢¥¯¥»¥¹¥³¥ó¥È¥í¡¼¥ë½ñË¡¤Î³ÈÄ¥¤µ¤ì¤¿Éôʬ¤Ë´Ø¤·¤Æ¤Ï¡¢ hosts_options(5) ¤Îʸ½ñ¤Ç²òÀ⤹¤ë¡£¤³¤Î³ÈÄ¥¤Ï¡¢¥×¥í¥°¥é¥à ¤¬ -DPROCESS_OPTIONS ¤ò»ØÄꤷ¤ÆºîÀ®¤µ¤ì¤¿¤«¤É¤¦¤«¤Ëº¸±¦¤µ¤ì¤ë¡£

°Ê²¼¤Îʸ¾Ï¤Ç¤Ï¡¢daemon ¤È¤Ï¥Í¥Ã¥È¥ï¡¼¥¯¥Ç¡¼¥â¥ó¤Î¥×¥í¥»¥¹ ̾¤ò°ÕÌ£¤·¡¢client ¤È¤Ï¡¢¥µ¡¼¥Ó¥¹¤òÍ׵᤹¤ë¥Û¥¹¥È¤Î̾Á°¡¢ ¤â¤·¤¯¤Ï¥Û¥¹¥È¤Î¥¢¥É¥ì¥¹¤ò°ÕÌ£¤·¤Æ¤¤¤ë¡£¥Í¥Ã¥È¥ï¡¼¥¯¥Ç¡¼¥â¥ó¤Î¥× ¥í¥»¥¹Ì¾¤Ï¡¢inetd ¤ÎÀßÄê¥Õ¥¡¥¤¥ëÃæ¤ËÌÀ¼¨¤µ¤ì¤Æ¤¤¤ë¡£  

ACCESS CONTROL FILES

*

(daemon,client) ¤ÎÁȹ礻¤¬ /etc/hosts.allow ¥Õ¥¡¥¤¥ë¤ÎÃæ¤Î ¥¨¥ó¥È¥ê¤È°ìÃפ¹¤ë¾ì¹ç¡¢¥¢¥¯¥»¥¹¤Ï¾µÂú¤µ¤ì¤ë¡£

*

¤â¤·¤¯¤Ï¡¢(daemon,client) ¤ÎÁȹ礻¤¬ /etc/hosts.deny ¥Õ¥¡ ¥¤¥ë¤ÎÃæ¤Î¥¨¥ó¥È¥ê¤È°ìÃפ¹¤ë¾ì¹ç¡¢¥¢¥¯¥»¥¹¤ÏµñÈݤµ¤ì¤ë¡£

*

¤½¤ì°Ê³°¤Î¾ì¹ç¡¢¥¢¥¯¥»¥¹¤Ï¾µÂú¤µ¤ì¤ë¡£

¥¢¥¯¥»¥¹¥³¥ó¥È¥í¡¼¥ë¤Î¥Õ¥¡¥¤¥ë¤¬Â¸ºß¤·¤Ê¤¤¾ì¹ç¤Ï¡¢¤½¤ì¤é¤Î¥Õ¥¡¥¤ ¥ë¤¬¶õ¤Ç¤¢¤Ã¤¿¤È¤ß¤Ê¤µ¤ì¤ë¡£¤·¤¿¤¬¤Ã¤Æ¡¢¥¢¥¯¥»¥¹¥³¥ó¥È¥í¡¼¥ë¤Ï¡¢ ¥¢¥¯¥»¥¹¥³¥ó¥È¥í¡¼¥ë¥Õ¥¡¥¤¥ë¤ò½àÈ÷¤·¤Ê¤¤»ö¤Ë¤è¤Ã¤ÆÄä»ß¤¹¤ë»ö¤¬¤Ç ¤­¤ë¡£  

ACCESS CONTROL RULES

*

²þ¹Ôʸ»ú¤Ï¡¢¥Ð¥Ã¥¯¥¹¥é¥Ã¥·¥å¤¬Á°¤ËÃÖ¤«¤ì¤¿¾ì¹ç¤Ï̵»ë¤µ¤ì¤ë¡£¤³¤ì ¤Ë¤è¤Ã¤Æ¡¢³Ú¤ËÊÔ½¸¤¹¤ë¤¿¤á¤ËŤ¤¹Ô¤òʬ³ä¤¹¤ë¤³¤È¤¬µö¤µ¤ì¤Æ¤¤¤ë¡£

*

¶õ¹Ô¡¢¤Þ¤¿¤Ï `#' ¤Ç»Ï¤Þ¤ë¹Ô¤Ï̵»ë¤µ¤ì¤ë¡£¤·¤¿¤¬¤Ã¤Æ¡¢¥³¥á¥ó¥È¤ò ÁÞÆþ¤·¤¿¤ê¡¢¥Û¥ï¥¤¥È¥¹¥Ú¡¼¥¹¤òÆþ¤ì¤ÆÆɤߤ䤹¤¯À°¤¨¤ë»ö¤¬µö¤µ¤ì¤Æ ¤¤¤ë¡£

*

¤½¤ì°Ê³°¤Î¹Ô¤Ï¡¢¼¡¤Ë¼¨¤¹¥Õ¥©¡¼¥Þ¥Ã¥È¤Ë½¾¤ï¤Ê¤±¤ì¤Ð¤Ê¤é¤Ê¤¤¡£¤¿¤À ¤· [] ¤Ç°Ï¤Þ¤ì¤ëÉôʬ¤ÏǤ°Õ¤Ç¤¢¤ë:

    daemon_list : client_list [ : shell_command ]

daemon_list ¤Ï¡¢¤Ò¤È¤Ä°Ê¾å¤Î¥Ç¡¼¥â¥ó¥×¥í¥»¥¹Ì¾ (argv[0] ¤ÎÃÍ) ¤Þ¤¿¤Ï¡¢¥ï¥¤¥ë¥É¥«¡¼¥É (¸å½Ò) ¤ò»È¤Ã¤¿¥ê¥¹¥È¤Ç¤¢¤ë¡£

client_list ¤Ï¡¢¤Ò¤È¤Ä°Ê¾å¤Î¡¢¥Û¥¹¥È̾¡¢¥Û¥¹¥È¥¢¥É¥ì¥¹¡¢¤Þ ¤¿¤Ï¡¢¥ï¥¤¥ë¥É¥«¡¼¥É (¸å½Ò) ¤ò»È¤Ã¤¿¡¢¥¯¥é¥¤¥¢¥ó¥È¤Î¥Û¥¹¥È̾¤«¥¢ ¥É¥ì¥¹¤Ë¥Þ¥Ã¥Á¤¹¤ë¥Ñ¥¿¡¼¥ó¤Î¥ê¥¹¥È¤Ç¤¢¤ë¡£

Ê£¹ç²½¤µ¤ì¤¿ daemon@host ¤ä user@host ¤È¤¤¤¦·Á¼°¤Ï¡¢ ¤½¤ì¤¾¤ì SERVER ENDPOINT PATTERNS ¤ª¤è¤Ó CLIENT USERNAME LOOKUP ¤Î¥»¥¯¥·¥ç¥ó¤Ç²òÀ⤹¤ë¡£

¥ê¥¹¥È¤Î³ÆÍ×ÁǤ϶õÇò¡¢¤Þ¤¿¤Ï¥«¥ó¥Þ¤Çʬ¤±¤Ê¤±¤ì¤Ð¤¤¤±¤Ê¤¤¡£

NIS (¤«¤Ä¤Æ¤Î YP) ¤Î netgroup Ì䤤¹ç¤ï¤»¤È¤¤¤¦Îã³°¤ò½ü¤¤¤Æ¤Ï¡¢ Á´¤Æ¤Î¥¢¥¯¥»¥¹¥³¥ó¥È¥í¡¼¥ë¤Î¥Á¥§¥Ã¥¯¤ÏÂçʸ»ú¾®Ê¸»ú¤òƱ°ì»ë¤·¤Æ¹Ô ¤Ê¤ï¤ì¤ë¡£  

PATTERNS

*

`.' ¤Ç»Ï¤Þ¤ë¸ì¡£¤â¤·¡¢¥Û¥¹¥È̾¤Î¸å¤í¤ÎÉôʬ¤¬¤³¤Î½ñ¼°¤Ç»ØÄꤵ¤ì ¤¿¥Ñ¥¿¡¼¥ó¤È°ìÃפ¹¤ë¤È¡¢¤½¤ì¤Ï¥Þ¥Ã¥Á¤È¤Ê¤ë¡£Î㤨¤Ð¡¢`.tue.nl' ¤È¤¤¤¦¥Ñ¥¿¡¼¥ó¤Ï¡¢`wzv.win.tue.nl'. ¤È¤¤¤¦¥Û¥¹¥È̾¤È¥Þ¥Ã¥Á¤·¤Æ ¤¤¤ë¡£

*

`.' ¤Ç½ª¤ï¤ë¸ì¡£¤â¤·¡¢¥Û¥¹¥È¥¢¥É¥ì¥¹¤ÎÁ°Éô¤Î¿ôÃÍ¥Õ¥£¡¼¥ë¥É¤¬¡¢ ¤³¤Î¸ì¤È°ìÃפ¹¤ë¤Ê¤é¡¢¤½¤ì¤Ï¥Þ¥Ã¥Á¤·¤Æ¤¤¤ë¡£Î㤨¤Ð¡¢`131.155.' ¤È¤¤¤¦¥Ñ¥¿¡¼¥ó¤Ï¡¢Eindhoven University network (131.155.x.x)¤Ë °¤¹¤ë (¤Û¤Ü)Á´¤Æ¤Î¥Û¥¹¥È¤Î¥¢¥É¥ì¥¹¤Ë¥Þ¥Ã¥Á¤·¤Æ¤¤¤ë¡£

*

`@' ¤Ç»Ï¤Þ¤ë¸ì¤Ï¡¢NIS (¤«¤Ä¤Æ¤Î YP) ¤Î¥Í¥Ã¥È¥°¥ë¡¼¥×̾¤È¤·¤Æ°· ¤ï¤ì¤ë¡£¤â¤·¡¢¥Û¥¹¥È¤¬¤½¤³¤ÇÌÀ¼¨¤µ¤ì¤¿¥Í¥Ã¥È¥°¥ë¡¼¥×̾¤Î¥á¥ó¥Ð¡¼ ¤Ç¤¢¤ë¾ì¹ç¤Ï°ìÃפ·¤¿¤â¤Î¤È¤Ê¤ë¡£¤³¤Î¥Í¥Ã¥È¥°¥ë¡¼¥×¤Î¥Þ¥Ã¥Á¤Ï¡¢¥Ç¡¼ ¥â¥ó¥×¥í¥»¥¹Ì¾¤ä¥¯¥é¥¤¥¢¥ó¥È¥æ¡¼¥¶¡¼Ì¾¤Î¤¿¤á¤Ë¤Ï¥µ¥Ý¡¼¥È¤µ¤ì¤Æ¤¤ ¤Ê¤¤¡£

*

`n.n.n.n/m.m.m.m' ¤È¤¤¤¦·Á¼°¤Ï`net/mask' ¤Î°ìÂФȤ·¤Æ²ò¼á¤µ¤ì ¤ë¡£¥Û¥¹¥È¥¢¥É¥ì¥¹¤Ï¡¢`net' ¤«¤é¸«¤ÆÀµ¥Ó¥Ã¥ÈÊý¸þ¤Ë¤¢¤ê¡¢¤«¤Ä `mask' ¤Ç¥Þ¥¹¥¯¤µ¤ì¤¿ÈÏ°ÏÆâ¤Ë¤¢¤ë¾ì¹ç¤Ë°ìÃפ¹¤ë¡£¤¿¤È¤¨¤Ð¡¢ net/mask ¤¬ `131.155.72.0/255.255.254.0'¤È¤Ê¤ë¥Ñ¥¿¡¼¥ó¤Ï¡¢ `131.155.72.0' ¤«¤é `131.155.73.255'¤Þ¤Ç¤ÎÈϰϤˤ¢¤ëÁ´¤Æ¤Î¥¢¥É ¥ì¥¹¤Ë¥Þ¥Ã¥Á¤¹¤ë¡£

WILDCARDS

ALL

¤¹¤Ù¤Æ¤Ë¹çÃפ¹¤ëËüǽ¤Ê¥ï¥¤¥ë¥É¥«¡¼¥É¡£

LOCAL

¥É¥Ã¥Èʸ»ú¤ò»ý¤¿¤Ê¤¤Á´¤Æ¤Î¥Û¥¹¥È¤Ë¥Þ¥Ã¥Á¡£

UNKNOWN

̾Á°¤ÎÌÀ¤é¤«¤Ç¤Ê¤¤¥æ¡¼¥¶¡¼¤Ë¥Þ¥Ã¥Á¡£¤½¤·¤Æ̾Á° ¤Þ¤¿¤Ï ¥¢¥É ¥ì¥¹¤¬ÉÔÌÀ¤ÊÁ´¤Æ¤Î¥Û¥¹¥È¤Ë¥Þ¥Ã¥Á¡£

¤³¤Î·Á¼°¤ÏÃí°Õ¤ò»ý¤Ã¤Æ»ÈÍѤ¹¤Ù¤­¤Ç¤¢¤ë:¥Û¥¹¥È̾¤Ï¡¢°ì»þŪ¤Ê¥Í¡¼ ¥à¥µ¡¼¥Ð¡¼¤ÎÌäÂê¤Ë¤è¤ê¡¢»È¤¨¤Ê¤¤¾ì¹ç¤¬¤¢¤ê¤¦¤ë¡£¤Þ¤¿¡¢¥Í¥Ã¥È¥ï¡¼ ¥¯¥¢¥É¥ì¥¹¤Ï¡¢¥½¥Õ¥È¥¦¥§¥¢¤«¤é¸«¤Æ¡¢¤É¤ó¤Ê¥¿¥¤¥×¤Î¥Í¥Ã¥È¥ï¡¼¥¯¤È ²ñÏ䷤Ƥ¤¤ë¤Î¤«¡¢ÆÃÄê¤Ç¤­¤Ê¤¤¾ì¹ç¤ÏÍøÍѤǤ­¤Ê¤¯¤Ê¤ë¡£

KNOWN

̾Á°¤ÎÌÀ¤é¤«¤Ê¥æ¡¼¥¶¡¼¤Ë¥Þ¥Ã¥Á¤¹¤ë¡£¤µ¤é¤Ë¡¢Ì¾Á° ¤È ¥¢¥É¥ì ¥¹¤ÎÌÀ¤é¤«¤Ê¥Û¥¹¥È¤Ë¥Þ¥Ã¥Á¤¹¤ë¡£

¤³¤Î·Á¼°¤ÏÃí°Õ¤ò»ý¤Ã¤Æ»ÈÍѤ¹¤Ù¤­¤Ç¤¢¤ë:¥Û¥¹¥È̾¤Ï¡¢°ì»þŪ¤Ê¥Í¡¼ ¥à¥µ¡¼¥Ð¡¼¤ÎÌäÂê¤Ë¤è¤ê¡¢»È¤¨¤Ê¤¤¾ì¹ç¤¬¤¢¤ê¤¦¤ë¡£¤Þ¤¿¡¢¥Í¥Ã¥È¥ï¡¼ ¥¯¥¢¥É¥ì¥¹¤Ï¡¢¥½¥Õ¥È¥¦¥§¥¢¤«¤é¸«¤Æ¡¢¤É¤ó¤Ê¥¿¥¤¥×¤Î¥Í¥Ã¥È¥ï¡¼¥¯¤È ²ñÏ䷤Ƥ¤¤ë¤Î¤«¡¢ÆÃÄê¤Ç¤­¤Ê¤¤¾ì¹ç¤ÏÍøÍѤǤ­¤Ê¤¯¤Ê¤ë¡£

PARANOID

̾Á°¤È¥¢¥É¥ì¥¹¤Î°ìÃפ·¤Ê¤¤Á´¤Æ¤Î¥Û¥¹¥È¤Ë¥Þ¥Ã¥Á¤¹¤ë¡£¤â¤· tcpd ¤¬ -DPARANOID (¤³¤ì¤Ï¥Ç¥Õ¥©¥ë¥È¤Ç¤¢¤ë) ¤ÇºîÀ®¤µ¤ì¤Æ¤¤¤ë¤Ê¤é¡¢¥¢¥¯¥» ¥¹¥³¥ó¥È¥í¡¼¥ë¥Æ¡¼¥Ö¥ë¤¬»²¾È¤µ¤ì¤ë¤è¤êÁ°¤Ë¡¢¤½¤Î¤è¤¦¤Ê¥¯¥é¥¤¥¢¥ó ¥È¤«¤é¤ÎÍ×µá¤ÏÍî¤È¤µ¤ì¤Æ¤·¤Þ¤¦¡£¤½¤Î¤è¤¦¤ÊÍ×µá¤ò¡¢¤µ¤é¤Ë¥³¥ó¥È¥í¡¼ ¥ë¤·¤¿¤¤¾ì¹ç¤Ï -DPARANOID ¤ò³°¤·¤Æ tcpd ¤ò¹½ÃÛ¤¹¤ë»ö¡£

OPERATORS

EXCEPT

´ðËÜŪ¤Ë¤Ï¡¢¼¡¤Ë¼¨¤¹¤è¤¦¤Ê·Á¼°¤Ç»ÈÍѤ¹¤ë: `list_1 EXCEPT list_2';¤³¤ì¤Ï list_2 ¤Ë¥Þ¥Ã¥Á¤¹¤ë¤â¤Î¤ò½ü¤¯¡¢ list_1 ¤Ë¥Þ¥Ã¥Á¤¹¤ë¤â¤ÎÁ´¤Æ¡¢¤Ë¹çÃפ¹¤ë¡£¤³¤Î EXCEPT ±é»» »Ò¤Ï¡¢daemon_lists ¤È client_lists ¤ÎÃæ¤Ç¤â»ÈÍѤǤ­¤ë¡£EXCEPT ±é »»»Ò¤Ï¡¢¥Í¥¹¥È(Æþ¤ì»Ò¤Ë)¤·¤Æ»È¤¦»ö¤â¤Ç¤­¤ë: ¤â¤·¥³¥ó¥È¥í¡¼¥ë½ñ¼° ¤¬´Ý³ç¸Ì¤ò»È¤¦»ö¤òµö²Ä¤·¤Æ¤¤¤¿¤Ê¤é¡¢`a EXCEPT b EXCEPT c'¤Ï¡¢ `(a EXCEPT (b EXCEPT c))' ¤È²ò¼á¤µ¤ì¤ë¤Ç¤¢¤í¤¦¡£

SHELL COMMANDS

¥·¥§¥ë¥³¥Þ¥ó¥É¤Ï¡¢inetd ¤Î PATH ÀßÄê¤È´ØÏ¢¤µ¤»¤Æ¤Ï¤¤¤±¤Ê¤¤¡£Âå¤ï ¤ê¤ËÀäÂХѥ¹¤òÍѤ¤¤ë¤«¡¢ËÁƬ¤ÇÌÀ¼¨Åª¤Ë PATH=whatever ¤òÀë¸À¤¹¤ë ¤Ù¤­¤Ç¤¢¤ë¡£

hosts_options(5) ¤Îʸ½ñ¤Ç¤Ï¡¢¸ß´¹À­¤Î¤Ê¤¤°Û¤Ê¤ëÊýË¡¤Ç¥·¥§ ¥ë¥³¥Þ¥ó¥É¤Î¥Õ¥£¡¼¥ë¥É¤ò»È¤¦¤¿¤á¤Î¡¢¤â¤¦¤Ò¤È¤Ä¤Î½ñ¼°¤ò²òÀ⤷¤Æ¤¤ ¤ë¡£  

% EXPANSIONS

%a (%A)

¥¯¥é¥¤¥¢¥ó¥È (¥µ¡¼¥Ð¡¼) ¥Û¥¹¥È¤Î¥¢¥É¥ì¥¹¡£

%c

¥¯¥é¥¤¥¢¥ó¥È¤Î¾ðÊó: user@host, user@address. ¥Û¥¹¥È̾¤«Ã±¤Ë¥¢¥É ¥ì¥¹¤«¤Ï¡¢ÍøÍѤǤ­¤ë¾ðÊó¤Ë°Í¸¤¹¤ë¡£

%d

¥Ç¡¼¥â¥ó¥×¥í¥»¥¹Ì¾ (argv[0] ¤ÎÃÍ)¡£

%h (%H)

¥¯¥é¥¤¥¢¥ó¥È (¥µ¡¼¥Ð¡¼) ¥Û¥¹¥È¤Î̾Á°¡¢¤â¤·¥Û¥¹¥È̾¤¬ÍøÍѤǤ­¤Ê¤¤ ¾ì¹ç¤Ë¤Ï¡¢¤½¤Î¥¢¥É¥ì¥¹¡£

%n (%N)

¥¯¥é¥¤¥¢¥ó¥È (¥µ¡¼¥Ð¡¼) ¥Û¥¹¥È¤Î̾Á° (¤â¤·¤¯¤Ï¡¢"unknown" ¤¢¤ë¤¤ ¤Ï "paranoid")¡£

%p

¥Ç¡¼¥â¥ó¥×¥í¥»¥¹¤Î id¡£

%s

¥µ¡¼¥Ð¡¼¤Î¾ðÊó: daemon@host, daemon@address, ¤¢¤ë¤¤¤Ïñ¤Ë¥Ç¡¼¥â ¥ó¤Î̾Á°¡£¤³¤ì¤ÏÍøÍѤǤ­¤ë¾ðÊó¤Ë°Í¸¤¹¤ë¡£

%u

¥¯¥é¥¤¥¢¥ó¥È¤Î¥æ¡¼¥¶¡¼Ì¾ (¤â¤·¤¯¤Ï¡¢"unknown")¡£

%%

ʸ»ú `%' ¤ØŸ³«¤µ¤ì¤ë¡£

% ¤ÎŸ³«¤¬¹Ô¤Ê¤ï¤ì¤ë¤³¤È¤Ë¤è¤Ã¤Æ¡¢¥·¥§¥ë¤òº®Í𤵤»¤ë²ÄǽÀ­¤Î¤¢¤ë ʸ»ú·²¤Ï¡¢¥¢¥ó¥À¡¼¥¹¥³¥¢¤Ø¤ÈÃÖ¤­´¹¤¨¤é¤ì¤ë¡£  

SERVER ENDPOINT PATTERNS

    process_name@host_pattern : client_list ...

¤³¤Î¤è¤¦¤Ê¥Ñ¥¿¡¼¥ó¤Ï¡¢¥Þ¥·¥ó¤¬Ê£¿ô¤Î°Û¤Ê¤ë¥¤¥ó¥¿¡¼¥Í¥Ã¥È¤Î¥Û¥¹¥È ̾¤È¥¤¥ó¥¿¡¼¥Í¥Ã¥È¤Î¥¢¥É¥ì¥¹¤ò»ý¤Ã¤Æ¤¤¤ë¾ì¹ç¤Ë»ÈÍѤ¹¤ë¡£¥µ¡¼¥Ó¥¹ ¥×¥í¥Ð¥¤¥À¤Ï¡¢°Û¤Ê¤ëÁÈ¿¥¤Ë°¤¹¤ë¤è¤¦¤Ê¥¤¥ó¥¿¡¼¥Í¥Ã¥È¾å¤Î̾Á°¤ò»ý ¤ÄFTP, GOPHER ¤¢¤ë¤¤¤Ï WWW ¤òÄ󶡤¹¤ë¤¿¤á¤Ë¡¢¤³¤Îµ¡Ç½¤òÍøÍѤǤ­ ¤ë¡£hosts_options(5) ʸ½ñ¤ÎÃæ¤Î `twist' ¤Î¥ª¥×¥·¥ç¥ó¤â»²¾È¤¹¤ë»ö¡£ ¤¢¤ë¥·¥¹¥Æ¥à (Solaris, FreeBSD) ¤Ç¤Ï¡¢¤Ò¤È¤Ä¤ÎʪÍýŪ¤Ê¥¤¥ó¥¿¡¼¥Õ¥§¡¼ ¥¹¤¬¡¢Ê£¿ô¤Î¥¤¥ó¥¿¡¼¥Í¥Ã¥È¥¢¥É¥ì¥¹¤ò»ý¤Ä»ö¤¬¤Ç¤­¤ë(¤½¤ì°Ê³°¤Î¥· ¥¹¥Æ¥à¤Ç¤Ï¡¢ÀìÍѤΥͥåȥ¥¯¥¢¥É¥ì¥¹¶õ´Ö¤Ë¤¢¤ëSLIP ¤ä PPP ¤Ê¤É ¤Îµ¿»÷¥¤¥ó¥¿¡¼¥Õ¥§¡¼¥¹¤Î½õ¤±¤ò¼Ú¤ê¤Ê¤±¤ì¤Ð¤Ê¤é¤Ê¤¤¤À¤í¤¦ )¡£

host_pattern ¤Ï¡¢client_lists ¤Î²òÀâʸ¤Ë¤¢¤Ã¤¿¡¢¥Û¥¹¥È̾¤È¥¢¥É¥ì ¥¹¤Î¤è¤¦¤Ê¡¢¤¤¤¯¤Ä¤«¤Îʸˡ¤Ë½¾¤¦¤³¤È¤Ë¤Ê¤ë¡£°ìÈÌŪ¤Ë¤Ï¡¢server endpoint information (¥µ¡¼¥Ð¡¼Â¦Ëöü¤Ç¤Î¾ðÊó)¤Ï¡¢ connection-oriented serveices (¥³¥Í¥¯¥·¥ç¥ó»Ø¸þ¤Î¹â¤¤¥µ¡¼¥Ó¥¹)¤Ç ¤Î¤ßÍøÍѤ¹¤ë»ö¤¬¤Ç¤­¤ë¡£  

CLIENT USERNAME LOOKUP

    daemon_list : ... user_pattern@host_pattern ...

¥Ç¡¼¥â¥ó¥é¥Ã¥Ñ¡¼¤Ï¡¢¥ë¡¼¥ë¤Ë½¾¤¦·Á¤Ç¥æ¡¼¥¶¡¼Ì¾¤òõºº¤¹¤ë¤è¤¦¤Ë¿¶ Éñ¤¦¤«(¥Ç¥Õ¥©¥ë¥È)¡¢¤¢¤ë¤¤¤Ï¾ï¤Ë¥¯¥é¥¤¥¢¥ó¥È¥Û¥¹¥È¤ËÌ䤤¹ç¤ï¤»¤ë ¤Î¤«¡¢¥³¥ó¥Ñ¥¤¥ë»þ¤ËÀßÄê²Äǽ¤È¤Ê¤Ã¤Æ¤¤¤ë¡£¥ë¡¼¥ë¤Ë½¾¤¦·Á¼°¤Ç¥æ¡¼ ¥¶¡¼Ì¾¤Îõºº¤ò¹Ô¤Ê¤¦¾ì¹ç¤Ë¤Ï¡¢¾å¤Îµ­½Ò¥ë¡¼¥ë¤Ï daemon_list ¤È host_pattern ¤ÎξÊý¤¬¥Þ¥Ã¥Á¤·¤¿¾ì¹ç¤Ë¤Î¤ß¡¢¥æ¡¼¥¶¡¼Ì¾¤Î õºº¤ò¹Ô¤Ê¤¦¤Ç¤¢¤í¤¦¡£

user_pattern ¤Ï¡¢¥Ç¡¼¥â¥ó¥×¥í¥»¥¹¤Î¥Ñ¥¿¡¼¥ó¤ÈƱ¤¸Ê¸Ë¡¤Ç¤¢¤ê¡¢¤¹ ¤Ê¤ï¤ÁƱ¤¸¥ï¥¤¥ë¥É¥«¡¼¥É·²¤¬Å¬ÍѤµ¤ì¤ë(¤¿¤À¤·¥Í¥Ã¥È¥°¥ë¡¼¥×¤Î¥á ¥ó¥Ð¡¼¥·¥Ã¥×¤Ï¥µ¥Ý¡¼¥È¤µ¤ì¤Ê¤¤)¡£¤·¤«¤·¤Ê¤¬¤é¡¢¤³¤ì¤Ï¥æ¡¼¥¶¡¼Ì¾ ¤Îõºº¤ËÆÈÀꤵ¤ì¤ë¤Ù¤­¤Ç¤Ï¤Ê¤¤¡£

*

¥¯¥é¥¤¥¢¥ó¥È¤Î¥æ¡¼¥¶¡¼Ì¾¤Ë´Ø¤¹¤ë¾ðÊó¤Ï¡¢Î㤨¤Ð¥¯¥é¥¤¥¢¥ó¥È¥·¥¹¥Æ ¥à¤¬¿®ÍѤ¹¤ë¤Ë­¤ê¤Ê¤¤¤â¤Î¤È¤Ê¤Ã¤Æ¤¤¤ë»þ¤Ë¤Ï¡¢¿®Íꤹ¤ë»ö¤Ï¤Ç¤­¤Ê ¤¤¡£°ìÈÌŪ¤Ë¤Ï¡¢ALL ¤È (UN)KNOWN ¤Ï°ÕÌ£¤Î¤¢¤ë¥æ¡¼¥¶¡¼Ì¾¤Î¥Ñ¥¿¡¼ ¥ó¤Î¤¿¤á¤Ë¤¢¤ë¡£

*

¥æ¡¼¥¶¡¼Ì¾¤Îõºº¤Ï TCP ¥Ù¡¼¥¹¤Î¥µ¡¼¥Ó¥¹¤Ç¡¢¤½¤·¤Æ¡¢¥¯¥é¥¤¥¢¥ó¥È ¥Û¥¹¥È¤¬Å¬Àڤʥǡ¼¥â¥ó¤òµ¯Æ°¤·¤Æ¤¤¤ë¾ì¹ç¤Ë¤Î¤ß²Äǽ¤Ç¤¢¤ë¡£¤½¤·¤Æ¡¢ ¤½¤ì°Ê³°¤Î¥±¡¼¥¹¤Ï "unknown" ¤Î·ë²Ì¤òÆÀ¤ë»ö¤Ë¤Ê¤ë¡£

*

¥æ¡¼¥¶¡¼Ì¾¤Îõºº¤¬¥Õ¥¡¥¤¥ä¡¼¥¦¥©¡¼¥ë¤Ë¤è¤Ã¤ÆÁˤޤ줿¾ì¹ç¡¢Í­Ì¾¤Ê UNIX ¥«¡¼¥Í¥ë¤Î¥Ð¥°¤¬¥µ¡¼¥Ó¥¹¤Ë»³²¤ò¤â¤¿¤é¤¹¤«¤â¤·¤ì¤Ê¤¤¡£ wrapper ¤Î README ʸ½ñ¤Ë¤Ï¡¢¤¢¤Ê¤¿¤Î¥«¡¼¥Í¥ë¤Ë¡¢¤³¤Î¥Ð¥°¤¬Â¸ºß¤¹ ¤ë¤«¤É¤¦¤«¤òÄ´¤Ù¤ë¼ê½ç¤¬¾Ò²ð¤µ¤ì¤Æ¤¤¤ë¡£

*

¥æ¡¼¥¶¡¼Ì¾¤Îõºº¤Ï¡¢non-UNIX ¥æ¡¼¥¶¡¼¤ËÂФ·¤Æ¹Ô¤Ê¤ï¤ì¤¿¾ì¹ç¡¢Ãø ¤·¤¯ÃÙ¤¯¤Ê¤ë¤«¤âÃΤì¤Ê¤¤¡£¥æ¡¼¥¶¡¼Ì¾¤Îõºº¤¬¥¿¥¤¥à¥¢¥¦¥È¤Ç½ªÎ»¤¹ ¤ë¤Þ¤Ç¤Î´ûÄêÃͤÏ10 ÉäȤʤäƤ¤¤ë: ¤³¤ì¤ÏÃÙ¤¤¥Í¥Ã¥È¥ï¡¼¥¯¤Ë¤È¤Ã ¤Æ¤Ïû¤¹¤®¤ë¤¬¡¢PC ¥æ¡¼¥¶¡¼¤ò¤¸¤é¤¹¤Ë¤Ï½¼Ê¬¤¹¤®¤ë¡£

¥æ¡¼¥¶¡¼Ì¾¤Îõºº¤òÁªÂò²Äǽ¤È¤¹¤ë¤³¤È¤Ë¤è¤ê¡¢ºÇ¸å¤ÎÌäÂê¤ò·Ú¸º¤¹¤ë ¤³¤È¤¬¤Ç¤­¤ë¡£¤¿¤È¤¨¤Ð¡¢¤³¤ó¤Ê¥ë¡¼¥ë:

    daemon_list : @pcnetgroup ALL@ALL

¤³¤ì¤Ï¥æ¡¼¥¶¡¼Ì¾¤Îõºº¤ò¹Ô¤Ê¤ï¤Ê¤¤ PC ¥Í¥Ã¥È¥°¥ë¡¼¥×¤Î¥á¥ó¥Ð¡¼¤Ë ¤â¥Þ¥Ã¥Á¤¹¤ë¤À¤í¤¦¤·¡¢¤½¤ì°Ê³°¤Î¥·¥¹¥Æ¥à¤ËÂФ·¤Æ¤Ï¥æ¡¼¥¶¡¼Ì¾¤Îõ ºº¤ò¹Ô¤Ê¤¦¤À¤í¤¦¡£  

DETECTING ADDRESS SPOOFING ATTACKS

¥¯¥é¥¤¥¢¥ó¥È¤ÎÍ×µá¤ËÅú¤¨¤ëÁ°¤Ë¡¢TCP ¥é¥Ã¥Ñ¡¼·²¤ÏËÜÅö¤Î¥¯¥é¥¤¥¢¥ó ¥È¤¬¼ÂºÝ¤Ë¤ÏÁ´¤¯Í×µá¤òÁ÷¤Ã¤ÆÍè¤Æ¤¤¤Ê¤«¤Ã¤¿¤³¤È¤òȯ¸«¤¹¤ëÌÜŪ¤Ç¡¢ IDENT ¥µ¡¼¥Ó¥¹¤ò»È¤¦»ö¤¬¤Ç¤­¤ë¡£

¥¯¥é¥¤¥¢¥ó¥È¥Û¥¹¥È¤¬ IDENT ¥µ¡¼¥Ó¥¹¤òÍÑ°Õ¤·¤Æ¤¤¤ë¤Ê¤é¡¢IDENT ¤Î Ì䤤¹ç¤ï¤»¤ò¤·¤Æ¡¢Ê֤äÆÍ褿·ë²Ì¤¬ÈÝÄêŪ(¥¯¥é¥¤¥¢¥ó¥È¥Þ¥·¥ó¤¬ `UNKNOWN@host') ¤Ç¤¢¤ì¤Ð¡¢¤½¤ì¤Ï¥Ú¥Æ¥ó¹¶·â¤Î³Î¸Ç¤¿¤ë¾Úµò¤È¤Ê¤ë¡£

¹ÎÄêŪ¤Ê IDENT ¤ÎÌ䤤¹ç¤ï¤»·ë²Ì (¥¯¥é¥¤¥¢¥ó¥È¥Þ¥·¥ó¤Ï `KNOWN@host')¤Ç¤â¡¢½¼Ê¬¤Ë¿®Íê¤Ç¤­¤ë¤È¤Ï¸À¤¤ÀÚ¤ì¤Ê¤¤¡£Ã±¤Ë¥¯¥é¥¤ ¥¢¥ó¥È¤Î¥³¥Í¥¯¥·¥ç¥ó¤ò¸íËâ²½¤¹¤è¤ê¤ÏÆñ¤·¤¤¤¬¡¢¤½¤ì¤Ç¤â¿¯Æþ¼Ô¤Ï¥¯ ¥é¥¤¥¢¥ó¥È¤Î¥³¥Í¥¯¥·¥ç¥ó¤È¡¢IDENT ¤ÎÌ䤤¹ç¤ï¤»¤ÎξÊý¤òµ¶¤Ã¤Æ¤¤¤ë ²ÄǽÀ­¤¬¤¢¤ë¡£¤µ¤é¤Ë¤Ï¡¢¥¯¥é¥¤¥¢¥ó¥È¤Î IDENT ¥µ¡¼¥Ð¡¼¤½¤Î¤â¤Î¤¬ ±³¤ò¤Ä¤¤¤Æ¤¤¤ë¤³¤È¤µ¤¨¹Í¤¨¤é¤ì¤ë¡£

Note: IDENT ¤ÎÌ䤤¹ç¤ï¤»¤Ï UDP ¥µ¡¼¥Ó¥¹¤È¶¦Â¸¤·¤ÆÆ°ºî¤¹¤ë»ö¤Ï¤Ç¤­¤Ê¤¤¡£  

EXAMPLES

°Ê²¼¤Îµ­½ÒÎã¤òÆɤà¤Ë¤¢¤¿¤Ã¤Æ¤Ï¡¢allow ¤Îµ­½Ò¤Ï deny ¤Îµ­½Ò¤è¤êÀè ¤Ë¸¡º÷¤µ¤ì¡¢¤½¤Î¸¡º÷¤ÏºÇ½é¤Ë¥Þ¥Ã¥Á¤·¤¿¤â¤Î¤Ç½ªÎ»¤È¤Ê¤ê¡¢¥Þ¥Ã¥Á¤· ¤¿¤â¤Î¤¬Á´¤¯¸«¤Ä¤«¤é¤Ê¤¤¾ì¹ç¤Ë¤Ï¡¢¥¢¥¯¥»¥¹¤Ï¾µÇ§¤µ¤ì¤ë¡¢¤È¤¤¤¦¤³ ¤È¤ò¤Ï¤Ã¤­¤ê¤ÈÍý²ò¤·¤Æ¤ª¤¯¤³¤È¤¬½ÅÍפǤ¢¤ë¡£

µ­½ÒÎã¤Ï¥Û¥¹¥È¤È¥É¥á¥¤¥ó¤Î̾Á°¤ò»È¤¦¡£¥Í¡¼¥à¥µ¡¼¥Ð¡¼¤Ø¤ÎÌ䤤¹ç¤ï ¤»¤¬°ì»þŪ¤Ë¼ºÇÔ¤·¤¿¾ì¹ç¤Î±Æ¶Á¤ò·Ú¸º¤¹¤ë¤¿¤á¤Ë¤Ï¡¢¤³¤ì¤é¤Ë¥¢¥É¥ì ¥¹¡¢¤«¤Ä¡¢¤¢¤ë¤¤¤Ï network/netmask ¤Î¾ðÊó¤ò´Þ¤á¤ë¤³¤È¤Ç¡¢²þÁ±¤¹ ¤ë»ö¤¬¤Ç¤­¤ë¡£  

MOSTLY CLOSED (¤Û¤ÜÊĺ¿)

¥Ç¥Õ¥©¥ë¥È¤Î¥Ý¥ê¥·¡¼(no access)¤Ï¡¢Ã±¤Ë deny file ¤ÎÃæ¤Çµ­½Ò¤µ¤ì ¤ë:

/etc/hosts.deny: ALL: ALL

¤³¤ì¤Ë¤è¤Ã¤Æ¡¢allow file ¤ÎÃæ¤Î¥¨¥ó¥È¥ê¤Ç¥¢¥¯¥»¥¹¤¬µö²Ä¤µ¤ì¤Ê¤¤ ¸Â¤ê¡¢Á´¤Æ¤Î¥Û¥¹¥È¤Ø¤Î¥µ¡¼¥Ó¥¹¤ÏµñÈݤȤʤ롣

ÌÀ¼¨Åª¤Ë¸¢¸Â¤ò¼ø¤±¤ë¥Û¥¹¥È¤Ï¡¢allow file ¤ÎÃæ¤Ç¥ê¥¹¥È¤µ¤ì¤ë¡£µ­ ½ÒÎã:

/etc/hosts.allow: ALL: LOCAL @some_netgroup
ALL: .foobar.edu EXCEPT terminalserver.foobar.edu

ºÇ½é¤Î¥ë¡¼¥ë¤Ç¤Ï¡¢¥í¡¼¥«¥ë¥É¥á¥¤¥ó(¥Û¥¹¥È̾¤Ë `.'¤òɬÍפȤ·¤Ê¤¤) ¤È¡¢some_netgroup ¤Ë°¤¹¤ë¥Û¥¹¥È¤«¤é¤Î¥¢¥¯¥»¥¹¤¬µö²Ä¤µ¤ì¤Æ ¤¤¤ë¡£ÆóÈÖÌܤΥ롼¥ë¤Ç¤Ï¡¢terminalserver.foobar.edu. ¤ò½ü ¤¯foobar.edu ¥É¥á¥¤¥ó(¥É¥Ã¥È¤Ç»Ï¤Þ¤ë¤³¤È¤¬Àë¸À¤µ¤ì¤Æ¤¤¤ë) ¤Î¡¢Á´¤Æ¤Î¥Û¥¹¥È¤«¤é¤Î¥¢¥¯¥»¥¹¤¬µö²Ä¤µ¤ì¤Æ¤¤¤ë¡£  

MOSTLY OPEN (¤Û¤Ü²òÊü)

¥Ç¥Õ¥©¥ë¥È¤Î¥Ý¥ê¥·¡¼(access granted) ¤Ë½¾¤¨¤Ð¡¢¤É¤ó¤Ê allow file ¤Ç¤â¡¢¤Þ¤Ã¤¿¤¯¾Êά²Äǽ¤Ê¤Û¤É¾éĹ¤Ê¤â¤Î¤È¤Ê¤ë¡£ÌÀ¼¨Åª¤Ë¸¢¸Â¤òÍ¿¤¨ ¤Ê¤¤¥Û¥¹¥È¤Ï¡¢deny file ¤Ë¥ê¥¹¥È¤¹¤ë¡£µ­½ÒÎã:

/etc/hosts.deny: ALL: some.host.name, .some.domain
ALL EXCEPT in.fingerd: other.host.name, .other.domain

ºÇ½é¤Î¥ë¡¼¥ë¤Ç¤Ï¡¢¤¤¤¯¤Ä¤«¤Î¥Û¥¹¥È¤È¡¢¥É¥á¥¤¥ó¤Ø¤ÎÁ´¤Æ¤Î¥µ¡¼¥Ó¥¹ ¤¬µñÈݤµ¤ì¤ë¡£ÆóÈÖÌܤΥ롼¥ë¤Ç¤Ï¡¢¤½¤ì°Ê³°¤Î¥Û¥¹¥È¤È¥É¥á¥¤¥ó¤«¤é ¤Î finger ¥ê¥¯¥¨¥¹¥È¤Ë¸Â¤Ã¤Æµö²Ä¤¬Í¿¤¨¤é¤ì¤Æ¤¤¤ë¡£  

BOOBY TRAPS (¤Ò¤Ã¤«¤±æ«)

/etc/hosts.allow:

in.tftpd: LOCAL, .my.domain

/etc/hosts.deny:
in.tftpd: ALL: (/some/where/safe_finger -l @%h | \
        /usr/ucb/mail -s %d-%h root) &

safe_finger ¥³¥Þ¥ó¥É¤Ï tcpd wrapper ¤ËÉÕ°¤·¤Æ¤ª¤ê¡¢Å¬Àڤʾì½ê¤Ë ¥¤¥ó¥¹¥È¡¼¥ë¤µ¤ì¤ë¤Ù¤­¤Ç¤¢¤ë¡£¤³¤ì¤Ï¥ê¥â¡¼¥È¤Î finger ¥µ¡¼¥Ð¡¼¤« ¤éÁ÷¤é¤ì¤Æ¤¯¤ë¥Ç¡¼¥¿¤Ë¤è¤Ã¤Æ¥À¥á¡¼¥¸¤¬Í¿¤¨¤é¤ì¤ë²ÄǽÀ­¤òÀ©¸Â¤·¤Æ ¤ë¡£¤³¤ì¤Ïɸ½à¤Î finger ¥³¥Þ¥ó¥É¤è¤ê¤âÍ¥¤ì¤¿Ëɸæ¤ò¤â¤¿¤é¤¹¡£

%h (client host) ¤È %d (service name) ¤ÎŸ³«¤Ë¤Ä¤¤¤Æ¤Ï¡¢shell commands ¤Î¥»¥¯¥·¥ç¥ó¤Ç²òÀ⤵¤ì¤Æ¤¤¤ë¡£

·Ù¹ð: finger ¤Î̵¸Â¥ë¡¼¥×¤Ø¤ÎÂн褬¤Ç¤­¤Ê¤¤¤Ê¤é¡¢¤¢¤Ê¤¿¼«¿È¤Î finger ¥Ç¡¼¥â¥ó¤ËÂФ·¤Æ¡¢¤³¤Î booby-trap (°ú¤Ã¤«¤±æ«) ¤ò»Å³Ý¤±¤Ê ¤¤»ö¡£

¥Í¥Ã¥È¥ï¡¼¥¯¥Õ¥¡¥¤¥ä¡¼¥¦¥©¡¼¥ë¤Ë¤ª¤¤¤Æ¤Ï¡¢¤³¤Î¥È¥ê¥Ã¥¯¤Ï¤µ¤é¤ËÂç Éý¤Ë³ÈÄ¥¤¹¤ë¤³¤È¤¬¤Ç¤­¤ë¡£Åµ·¿Åª¤Ê¥Í¥Ã¥È¥ï¡¼¥¯¥Õ¥¡¥¤¥ä¡¼¥¦¥©¡¼¥ë ¤Ï¡¢³°Éô¤ËÂФ·¤Æ¸ÂÄꤵ¤ì¤¿¥µ¡¼¥Ó¥¹¤·¤«Ä󶡤·¤Ê¤¤¡£¤½¤ì°Ê³°¤Î¥µ¡¼ ¥Ó¥¹¤Ï¡¢¾åµ­¤Î tftp ¤ÎÎã¤Î¤è¤¦¤Ë "ÅðÄ°" ¤¹¤ë¤³¤È¤¬¤Ç¤­¤ë¡£¤½¤Î·ë ²Ì¡¢¶Ë¤á¤ÆÍ¥¤ì¤¿Áá´ü·Ù²üÁõÃ֤Ȥʤ롣
 

DIAGNOSTICS

FILES

/etc/hosts.allow, ¥¢¥¯¥»¥¹¤òµö²Ä¤¹¤ë (daemon,client) ¤Î¥Ú¥¢¡£
/etc/hosts.deny, ¥¢¥¯¥»¥¹¤òµñÈݤ¹¤ë (daemon,client) ¤Î¥Ú¥¢¡£

SEE ALSO

tcpd(8) tcp/ip daemon wrapper ¥×¥í¥°¥é¥à
tcpdchk(8), tcpdmatch(8), test programs.

BUGS

¥É¥á¥¤¥ó¥Í¡¼¥à¥µ¡¼¥Ð¡¼¤ÎÌ䤤¹ç¤ï¤»¤Ï¡¢Âçʸ»ú¾®Ê¸»ú¤òƱ°ì»ë¤¹¤ë¡£ °ìÊý NIS (¤«¤Ä¤Æ¤Î YP) ¤Î¥Í¥Ã¥È¥°¥ë¡¼¥×¤Ï¡¢Âçʸ»ú¾®Ê¸»ú¤ò¶èÊ̤¹ ¤ë¡£  

AUTHOR

Wietse Venema (wietse@wzv.win.tue.nl)
Department of Mathematics and Computing Science
Eindhoven University of Technology
Den Dolech 2, P.O. Box 513, 
5600 MB Eindhoven, The Netherlands

ËÝÌõ¼Ô

FUKUSHIMA Osamu/Ê¡Åç±÷½¤ <fuku@amorph.rim.or.jp>

Index

NAME

DESCRIPTION

ACCESS CONTROL FILES

ACCESS CONTROL RULES

PATTERNS

WILDCARDS

OPERATORS

SHELL COMMANDS

0.000000E+00XPANSIONS

SERVER ENDPOINT PATTERNS

CLIENT USERNAME LOOKUP

DETECTING ADDRESS SPOOFING ATTACKS

EXAMPLES

MOSTLY CLOSED (¤Û¤ÜÊĺ¿)

MOSTLY OPEN (¤Û¤Ü²òÊü)

BOOBY TRAPS (¤Ò¤Ã¤«¤±æ«)

DIAGNOSTICS

FILES

SEE ALSO

BUGS

AUTHOR

ËÝÌõ¼Ô