Thread: Howto : Tcp wrappers
09-08-2006, 08:36 AM #1Disabled
- Join Date
- Aug 2006
Howto : Tcp wrappers
Tcp wrappers provides the following advantages against network services
Almost every application of the TCP/IP protocols is based on a client-
server model. for example telnet, ftp, ssh, etc..
TCP wrappers is used to allow/grant or deny access to the various services on your maschine from remote client/ or to the outside network or other machines on the same network. it does this by using two files called:
When a connection attempt is made to a TCP wrapped service, the service first references the hosts access files (/etc/hosts.allow and /etc/hosts.deny) to determine whether or not the client host is allowed to connect. In most cases, it then uses the syslog daemon (syslogd) to write the name of the requesting host and the requested service to /var/log/secure or /var/log/messages .
- Rules define in hosts.allow takes precedence over rules in hosts.deny .
- You can have only one rule per service in hosts.allow and hosts.deny file.
- If there are no matching rules in either of the files or if the files don't exist, then the remote machine is allowed access to the service.
- Any changes to hosts.allow and hosts.deny file takes immediate effect.
Some of the example of it:
syntax of host access file: <daemon list>: <client list> [: <option>: <option>: ...]
The following wildcards may be used:
ALL — Matches everything. It can be used for both the daemon list and the client list.
LOCAL — Matches any host that does not contain a period (.), such as localhost.
KNOWN — Matches any host where the hostname and host address are known or where the user is known.
UNKNOWN — Matches any host where the hostname or host address are unknown or where the user is unknown.
PARANOID — Matches any host where the hostname does not match the host address.
vsftpd : .example.com
This rule instructs TCP wrappers to watch for connections to the FTP daemon (vsftpd) from any host in the example.com domain. If this rule appears in hosts.allow, the connection will be accepted. If this rule appears in hosts.deny, the connection will be rejectedALL : .xyz.com
Matches all hosts in the xyz.com domain . Note the dot (.) at the beginning.ALL : 123.12.
Matches all the hosts in the 220.127.116.11 network. Note the dot (.) in the end of the rule.ALL : 192.168.0.1/255.255.255.0
IP address/Netmask can be used in the rule
sshd : 192.168.5.5 : spawn /bin/echo `/bin/date` from %h >> /var/log/ssh.log : deny
Each time the rule is satisfied, the current date and the clients hostname %h is appended to the ssh.log file.
strings -f <binary-name> | grep hosts_access
# strings /usr/sbin/sendmail | grep hosts_access
Replacing <binary-name> with the name of the network service binary. If a prompt is returned, then the network service is not linked against libwrap.a .
Last edited by sysconfig; 09-08-2006 at 08:41 AM.