Re: per_source on redhat 7.2

>Is it possible that xinetd is getting hit by so many
>connections at the same time that it lets through more
>than the per_source value?

Not likely. The code is very well serialized. This check is
done pre-fork. The xinetd daemon walks its table of child
processes and counts them. It counts them on a per-service
basis...meaning each unique service entry in xinetd rather
than all of ftp. If you have 4 IP addresses and each has
its own unique xinetd service entry with their own
only_from, then xinetd will only count concurrent
connections for a specific service entry...not all 4. The
sigchld handler only sets a flag that a child exitted and
does nothing else. There is next to no chance of a child
getting away from us.

There has also been several bug fixes put into cvs that
corrects xinetd reloading. If you send xinetd SIGHUP to
re-read its configuration, it doesn't always work
correctly. Curent cvs works much much better. (I was hoping
2.3.12 would be released by now so those problems go away.)
The work around is to completely stop xinetd and then start
it. I don't know if that is causing your problems.

Try testing on a smaller scale in a controlled environment
and I think you should see that it works fine. BTW, what
happens when you start 6 sessions to the same IP-address on
your ftp server? Do you get rejected on the 6th connection?
Does 5 of them succeed?

-Steve Grubb

__________________________________
Do you Yahoo!?
SBC Yahoo! DSL - Now only $29.95 per month!
http://sbc.yahoo.com