TCPWRAPPERS

• One of the problems with TCP/IP is that it is basically insecure. Many intrusions are the result of this insecurty.
• TCP Wrappers solves this by restricting services that can be used.
• TCP Wrappers is a daemon that is run instead of inetd. It intercepts requests and either allows inetd to run and service the request or does not run inetd, thereby denying the request.
• TCP Wrappers handles telnet, finger, ftp, exec, rsh, rlogin, tftp, talk, comsat, and other services that have a one-to-one mapping onto executable files.
• TCP Wrappers consists of:
• hosts.allow and hosts.deny files with the rules for allowed and denied services
• tcpdchk program that checks configuration files for problems
• tcpdmatch program that reports how a service will be handled
• Configure hosts.allow and hosts.deny files
• First, decide on strategy
• If you have a high level of trust then allow everything that isn't specifically denied
• If you have a low level of trust then deny everything that isn't specifically allowed
• Then set up hosts.allow and hosts.deny files
• Remember that hosts.allow is examined first
• For a mostly open system, leave hosts.allow empty and put denied services in hosts.deny
• For a mostly closed system, put "ALL : ALL" in hosts.deny and then put allowed services in hosts.allow
• Example - mostly closed system
• hosts.allow
ALL : localhost
in.telnetd : gilton.net
in.fingerd : jeff1.gilton.net

This configuration allows any service for the local machine, telnet for any machine on the gilton network, allows finger for jeff1 on the gilton network

• hosts.deny
ALL : ALL
in.telnetd : ann.gilton.net

Anything else is denied. Note that second line doesn't do anything because second line of hosts.allow lets any machine on gilton network use telnet.

CLUG HOME | Events | Directions | Members | Mailing Lists (archives, FAQ)
Resources | Search | Library | Presentations | Contributions | Bylaws | Board Minutes