per_source on redhat 7.2

George Law <[email protected]> Mon, 30 Jun 2003 09:28:05 -0400
Newsgroups gmane.network.xinetd
Message-ID <[email protected]>
We are using xinetd on redhat 7.2 systems.  We maintain everything
through up2date, and the most current version of redhat's rpm for
xientd is xinetd-2.3.11-1.7x.


I have been trying to use per_source to limit connects per IP
address.  Once in a while, we will see syslog messages like:

Jun 29 22:46:16 xx xinetd[9980]: Deactivating service ftp due to excessive incoming connections.  Restarting in 30 seconds.
Jun 29 22:46:46 xx xinetd[9980]: Activating service ftp

This looks like a typical DoS attack which it sounds like the
per_source option will catch.

I have per_source = 5 in both /etc/xinetd.conf and
/etc/xinetd.d/wu-ftp, however it doesn't seem to make a bit of
difference.

I went as far as downloading the source plus the src RPM to see if
there was a configure option which needed to be turned on to allow
per_source, but I don't see any special flags, so I assume this is
enabled by default. 

Anyone have any suggestions?

TIA
-- 
Cordially,

				          George Law 
____________________________________________________________________
Systems Engineer                      Software Workshop Inc.
[email protected] 315.635-1968 (x-213)     "software that fits!" (TM)