Bhaskar :: Deploying GT.M based TCP services with xinetd

Deploying GT.M applications with xinetd K.S. Bhaskar Fidelity National Information Services. Inc. ks.bhaskar@fnis.com +1 (610) 5784265 http://fisgtm.com

GT.M philosophy • “Small is beautiful” – Applies to conceptual simplicity not to capability (GT.M today runs the largest real time core processing system live at any bank anywhere in the world) – An ecosystem of components where each does its job well, and uses other components for what they do well – An enhancement or fix to a component is immediately available to all that use it – Also the UNIX/Linux philosophy 2

The bazaar vs. the cathedral • So many choices – inetd / xinetd – sh / ksh / bash / csh ... – AIX / Solaris / HPUX / Linux • Red Hat / SuSE / Ubuntu ... • Vs. just choose one vendor to provide the whole ball of wax – Fly on auto pilot, no need to think 3

Simple setup • TCP port in /etc/services • Service in a file in /etc/xinetd.d • Shell script or program to provide service (Walk through example) 4

Benefits of xinetd – Internet superserver • Access control • Protection against denial of service attacks • Logging • Bind services to IP addresses • Simplified application server logic – Process starts with STDIN/STDOUT ($Principal) connected to client – Only needs to implement application specific communication – Only requires normal user privileges 5

Access control • Address, name, domain name of remote host • Time of access 6

Protection against DOS attacks via limits • Number of servers for each service • Number of process forked • Size of log files • Number of connections from a single host • System load Security is based on layers of protection – an Internet superserver like xinetd is just one more layer. 7

Optional logging • For all connection attempts, successful as well as failing – Time server was started – Remote host address – Remote user id (if supported by remote server – not likely for an attacker) • How long server ran • More 8

¿¿Questions?? ¡¡Comments!! K.S. Bhaskar ks.bhaskar@fnis.com +1 (610) 578-4265 9

http://www.outoftheslipstream.com	24
http://www.outoftheslipstream.org	7
http://www.slideshare.net	3
http://www.spokenword.org	1

Bhaskar :: Deploying GT.M based TCP services with xinetd

by george.james on Sep 28, 2007

Accessibility

Categories

Tags

Upload Details

Usage Rights

4 Embeds 35

Statistics

Bhaskar :: Deploying GT.M based TCP services with xinetd — Webinar Transcript