How to restrict remote logon by IP address in UNIX

Article Title: how to restrict remote logon by IP address in UNIX. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.

During routine maintenance or security reinforcement, we often need to restrict the IP addresses of access clients to implement system operations, this article summarizes how to use IP addresses to restrict remote logon on ibm aix, hp ux, and sun solaris operating systems.

　1. HP-UX

1.1/var/adm/inetd. sec

In hp ux, you can restrict the IP address and the service connected through this IP address. In the HP system, there is a configuration file inetd. sec, which is used to set each service to allow or prohibit certain network addresses. In the system default installation, the file content is null or does not exist, that is, the system allows any address to use any service of the local machine by default.

Setting method:

1. check whether/var/adm/inetd. sec exists. if not, create it as the root user:

# Touch/var/adm/inetd. sec

2. edit the/var/adm/inetd. sec file to ensure that the file contains the following lines, for example:

Shell allow 139.104.8.21 139.104.8.22

Login allow 139.104.8.1-64 139.104.4.1-64

Telnet allow 139.104.8.1-128 139.104.4.1-128

Ftp allow 139.104.8.1-128 139.104.4.1-128

First, describe the meaning of each field in each row. The first column is the service name, corresponding to the first column of/etc/services. The second column is the permission, which can be allow or deny. if it is allow, it means that access is only allowed by the addresses in the following address list. The third column is the address list. Separate multiple addresses with spaces, which can be a complete IP address or CIDR block address or a network name. Wildcard (*) and range character (-) are allowed in the address list.

The above example is a typical SCP restriction configuration of mobile intelligent network. The first line of shell is used to configure the addresses allowed by rsh. because rsh is required between two hosts, therefore, the/var/adm/inetd of the two hosts must be ensured. the sec includes the IP addresses of each other.

The second line of login is used to configure the addresses allowed by rlogin. because rlogin needs to be used between two hosts on both hosts, the/var/adm/inetd of the two hosts on both hosts must be ensured. the sec includes the IP addresses of each other.

The third line is used to configure the addresses allowed by telnet. here is the IP address of the remote terminal that the local authority allows to log on to. you can configure the IP address as needed.

The fourth line is used to configure the addresses allowed by ftp. Note that SMP needs to access the scp ftp service, SMAP also needs to access the smp ftp service, and RBI needs to access the scp ftp service. Therefore, the SMP address must be added to the SCP, SMP needs to add the SMAP address list

3. modify the attributes of the/var/adm/inetd. sec file to prevent others from writing:

# Chmod 444/var/adm/inetd. sec

Note that the purpose of using this function is to restrict access to some clients. to add allow or deny, make sure that the packages to be accessed are included in allow or not in deny. After receiving the user's login application, the UNIX host will check the service name, such as the telnet (23) service. if the configuration file contains the telnet service and the allow item is configured, the connected IP address is in the list of allow items before the system allows this IP address to log on. Otherwise, the system will not allow this IP address to be connected. If deny is configured, the connected IP address must not be in the deny list before the system can connect to the IP address.

1.2 FTP service,

The FTP service can be set for users by adding a username per line by configuring the/etc/ftpd/fpaccess file in the HP-UX system, the system will only allow users configured in this file to perform FTP operations. Note that the FTP account name must be included in the production system.

[1] [2] [3] [4] [5] Next page