[1393] in linux-security and linux-alert archive
[linux-security] Re: Re: Re: xinetd v. tcp-wrappers
daemon@ATHENA.MIT.EDU (Wietse Venema)
Fri Jan 17 08:52:25 1997
From: wietse@porcupine.org (Wietse Venema)
To: linux-security@redhat.com
Date: Thu, 16 Jan 1997 15:08:31 -0500 (EST)
In-Reply-To: <m0vkrCM-00071wC@dingo.theplanet.co.uk> from "Nigel Metheringham" at Jan 16, 97 12:45:38 pm
Resent-From: linux-security@redhat.com
Reply-To: linux-security@redhat.com
I'm the author of tcpd, so my answer is certainly biased.
tcpd is from the `smaller is better' school. It sacrifices some
cpu cycles to minimize the risk of running it. xinetd saves a few
cpu cycles but it involves an order of magnitude more code, not
counting helper utilities.
Wietse
>
> } Xinetd will perform its checks, fork and exec the service program. It does
> } not do much of the "paranoid" DNS verification that tcpd does.
> }
> } [mod: Thus it is open to the attack that the "paranoid" DNS verification
> } fixes. i.e. create a reverse mapping for bad.host.attacker.com that reads
> } trusted.host.victim.com and you can use services that were not intended
> } for you.... -- REW]
>
> Not exactly... xinetd does *no* DNS checks so is immune to DNS spoofing!
> The access controls are specified as IP addresses. This is obviously good
> for some applications and rubbish for others (you can always run tcpd
> under xinetd).
>
> [mod: I stand corrected. Thanks. -- REW]
>
> Adding tcpd's domain lookups into xinetd would require xinetd to fork and
> then do its access checks since the DNS calls would otherwise block xinetd
> causing it to be very sluggish.
>
> NB If people are interested I have a patch around which adds explicit
> netmask specification to all address range specs. I have passed this to
> the maintainers, but its not been taken up as yet.
>
> Nigel.
>
>
> --
> [ Nigel.Metheringham@theplanet.net - Unix Applications Engineer ]
> [ *Views expressed here are personal and not supported by PLAnet* ]
> [ PLAnet Online : The White House Tel : +44 113 251 6012 ]
> [ Melbourne Street, Leeds LS2 7PS UK. Fax : +44 113 2345656 ]
> [Q: You know when you run sendmail.... A: No, you DELETE sendmail]
>
>
