Chapter 17. TCP Wrappers and xinetd
iptables-based firewall filters out unwelcome network packets within the kernel's network stack. For network services that utilize it, TCP wrappers add an additional layer of protection by defining which hosts are or are not allowed to connect to "wrapped" network services. One such wrapped network service is the
xinetdsuper server. This service is called a super server because it controls connections to a subset of network services and further refines access control.
Figure 17.1. Access Control to Network Services
xinetdin controlling access to network services and reviews how these tools can be used to enhance both logging and utilization management. For a discussion of using firewalls with
iptables, refer to Chapter 18,
17.1. TCP Wrappers
tcp_wrappers) is installed by default and provides host-based access control to network services. The most important component within the package is the
/usr/lib/libwrap.alibrary. In general terms, a TCP wrapped service is one that has been compiled against the
/etc/hosts.deny) to determine whether or not the client host is allowed to connect. In most cases, it then uses the syslog daemon (
syslogd) to write the name of the requesting host and the requested service to
libwrap.alibrary. Some such applications include
libwrap.a, type the following command as the root user:
ldd binary-name | grep libwrap
17.1.1. Advantages of TCP Wrappers
- Transparency to both the client host and the wrapped network service — Both the connecting client and the wrapped network service are unaware that TCP wrappers are in use. Legitimate users are logged and connected to the requested service while connections from banned clients fail.
- Centralized management of multiple protocols — TCP wrappers operate separately from the network services they protect, allowing many server applications to share a common set of configuration files for simpler management.