Well, I have looked a little at xinetd's code, but I think it's pretty
secure. Basically, it probably does a getsockname() on incoming
connections to find out what interface they are coming in on. It then
would compare the result to an IP address or interface name and make
sure they match. I haven't looked in full at the code here, but I would
place high faith on this part because it is not that tricky to do. What
I wouldn't place faith on is the kernel's IP forwarding mechanism. On
many BSD based systems, it is possible to ping an inside interface from
the outside, even with IP forwarding turned off (so I have been told).
I know for a fact that Linux-2.0 and higher (and probably earlier as
well) are not vulnerable to this. This is easy to check - try to ping
your outside interface from the inside - if that works, your IP
forwarding is broken, and xinetd's interface binding is useless for you
purposes.
Zach Amsden
amsden @
andrew .
cmu .
edu
Follow-Ups:
References:
|
|
