linux 下的访问控制

时间：2006-01-20 来源：atg

@--------------------------------------------------------------------------------------
@ - 限制IP
@ - linux
@ - 2005-08-11
@ - ATG
@--------------------------------------------------------------------------------------

1.1 在LINUX下我们可以有很多方法可以控制用户的登路
    1.1.1 我先讲讲怎么控制ftp服务吧
        在/etc/ftpusers 这个文件可以控制用户的的FTP只要把用户名写入文件就可以了!
        ------------------------------------------------------------------------
      - |# ftpusers      This file describes the names of the users that may
        |#_*NOT*_ log into the system via the FTP server.
        |#This usually includes "root", "uucp", "news" and the
        |#like, because those users have too much power to be
        |#allowed to do "just" FTP...
        |#
        |adabas
        |amanda
        |at
        |bin
        |cyrus
        |daemon
        |dbmaker
        |db2fenc1
        ---------------------------------------------------------------------------
    1.1.2 来一个更NB的就是把LINUX的全部方式都不能登路
        在/ect/hosts.allow 与 /ect/hosts.deny这两个文件
        我们先看一下hosts.deny这是用来关闭服务的
        ---------------------------------------------------------------------------
        # /etc/hosts.deny
        # See `man tcpd?and `man 5 hosts_access?as well as /etc/hosts.allow
        # for a detailed description.

        http-rman : ALL EXCEPT LOCAL
        // 以下我们自己加上去的
        #ALL: ALL@ALL, PARANOID    // 表示把全部关闭
        in.telnetd : ALL@ALL, PARANOID
        pure-ftpd : ALL@ALL, PARANOID
        ---------------------------------------------------------------------------

        然后再看看hosts.allow这是用来控制服务的
        -------------------------------------------------------------------------------------------
        # Example 3: run a different instance of rsyncd if the connection comes
        #            from network 172.20.0.0/24, but regular for others:
        # rsyncd : 172.20.0.0/255.255.255.0 : twist /usr/local/sbin/my_rsyncd-script
        # rsyncd : ALL : ALLOW
        #
        // 以下我们自己加上去的
        //             表示只有这个网段才能上      但这两个不能上
        //                    |                           |
        in.telnetd : 192.118.103. EXCEPT 192.118.103.250 192.118.103.253
        in.telnetd : ALL : \
           twist /bin/echo -e "\n\raccess from %h declined(拒绝连接).\n\r未经认证Go away.";sleep 2

        in.telnetd : 192.118.128.
        in.telnetd : ALL : \
           twist /bin/echo -e "\n\raccess from %h declined(拒绝连接).\n\r未经认证Go away.";sleep 2

        in.telnetd : 192.119.172.
        in.telnetd : ALL : \
           twist /bin/echo -e "\n\raccess from %h declined(拒绝连接).\n\r未经认证Go away.";sleep 2

        pure-ftpd : 192.118.103. EXCEPT 192.118.103.250
        pure-ftpd : ALL : \
           twist /bin/echo -e "\n\raccess from %h declined.\n\r未经认证Go away.";sleep 2

        #pure-ftpd : 192.118.128.
        #pure-ftpd : ALL : \
        #   twist /bin/echo -e "\n\raccess from %h declined.\n\r未经认证Go away.";sleep 2

        pure-ftpd : 192.119.172.
        pure-ftpd : ALL : \
           twist /bin/echo -e "\n\raccess from %h declined.\n\r未经认证Go away.";sleep 2
        ---------------------------------------------------------------------------------------------
        OK到这就搞定了!