Allow access to a xinetd service only when client connects to a specific subdomain

Question

This question is regarding a dedicated server running CentOS 5.4. I can connect as root for hairier configuration tasks if needed.

I'm writing because I've set up svnserve to handle requests using xinetd. This is working perfectly and I'm happily committing and checking out without issue.

This server is also hosting some other domains and I can connect to svnserve through any of them, since they're all sharing the same IP. The repositories have been secured using svnserve's authentication measures, so this isn't a big deal, but:

Is it possible to only allow connections to svnserve when clients access it via sub.mydomain.com? I have scoured the documention for xinetd and TCP_wrappers looking for a solution but nothing yet.

(I know one option would be to use DAV svn instead of svnserve but I have followed a couple of tutorials to get that running and failed each time. A solution with svnserve would be preferable since it's actually working quite nicely for me.)

Thanks for the help!

Answer 1

Xinetd calls servers (in your case svnserve) but doesn't access the data they manage. For this reason, xinetd can filter incoming addresses (only_from), but not requested domains, since requested domains are not announced to xinetd, but passed on to the server.

As suggested, you might want to use a dedicated IP address for this service so you can bind the service to this address only (using the bind parameter).

Answer 2

How do you know what domain name they have requested? The reason you can do it with DAV is because that would run under apache (or another web server.) Web servers have the concept of virtualhosts. Svnserve does not. You'll have to use DAV to get this functionality.

Answer 3

You could get an extra IP address, just for this subdomain.