2.6.2. TCP Wrappers Configuration Files
- It references
/etc/hosts.allow— The TCP-wrapped service sequentially parses the
/etc/hosts.allowfile and applies the first rule specified for that service. If it finds a matching rule, it allows the connection. If not, it moves on to the next step.
- It references
/etc/hosts.deny— The TCP-wrapped service sequentially parses the
/etc/hosts.denyfile. If it finds a matching rule, it denies the connection. If not, it grants access to the service.
- Because access rules in
hosts.alloware applied first, they take precedence over rules specified in
hosts.deny. Therefore, if access to a service is allowed in
hosts.allow, a rule denying access to that same service in
- The rules in each file are read from the top down and the first matching rule for a given service is the only one applied. The order of the rules is extremely important.
- If no rules for the service are found in either file, or if neither file exists, access to the service is granted.
- TCP-wrapped services do not cache the rules from the hosts access files, so any changes to
hosts.denytake effect immediately, without restarting network services.
/var/log/secure. This is also the case for a rule that spans multiple lines without using the backslash character. The following example illustrates the relevant portion of a log message for a rule failure due to either of these circumstances:
warning: /etc/hosts.allow, line 20: missing newline or line too long
184.108.40.206. Formatting Access Rules
/etc/hosts.denyis identical. Each rule must be on its own line. Blank lines or lines that start with a hash (#) are ignored.
<daemon list> : <client list> [: <option> : <option> : …]
- <daemon list> — A comma-separated list of process names (not service names) or the
ALLwildcard. The daemon list also accepts operators (refer to Section 220.127.116.11.4, “Operators”) to allow greater flexibility.
- <client list> — A comma-separated list of hostnames, host IP addresses, special patterns, or wildcards which identify the hosts affected by the rule. The client list also accepts operators listed in Section 18.104.22.168.4, “Operators” to allow greater flexibility.
- <option> — An optional action or colon-separated list of actions performed when the rule is triggered. Option fields support expansions, launch shell commands, allow or deny access, and alter logging behavior.
vsftpd : .example.com
vsftpd) from any host in the
example.comdomain. If this rule appears in
hosts.allow, the connection is accepted. If this rule appears in
hosts.deny, the connection is rejected.
sshd : .example.com \ : spawn /bin/echo `/bin/date` access denied>>/var/log/sshd.log \ : deny
sshd) is attempted from a host in the
example.comdomain, execute the
echocommand to append the attempt to a special log file, and deny the connection. Because the optional
denydirective is used, this line denies access even if it appears in the
hosts.allowfile. Refer to Section 22.214.171.124, “Option Fields” for a more detailed look at available options.
ALL— Matches everything. It can be used for both the daemon list and the client list.
LOCAL— Matches any host that does not contain a period (.), such as localhost.
KNOWN— Matches any host where the hostname and host address are known or where the user is known.
UNKNOWN— Matches any host where the hostname or host address are unknown or where the user is unknown.
PARANOID— A reverse DNS lookup is done on the source IP address to obtain the host name. Then a DNS lookup is performed to resolve the IP address. If the two IP addresses do not match the connection is dropped and the logs are updated
PARANOIDwildcards should be used with care, because they rely on a functioning DNS server for correct operation. Any disruption to name resolution may prevent legitimate users from gaining access to a service.
- Hostname beginning with a period (.) — Placing a period at the beginning of a hostname matches all hosts sharing the listed components of the name. The following example applies to any host within the
ALL : .example.com
- IP address ending with a period (.) — Placing a period at the end of an IP address matches all hosts sharing the initial numeric groups of an IP address. The following example applies to any host within the
ALL : 192.168.
- IP address/netmask pair — Netmask expressions can also be used as a pattern to control access to a particular group of IP addresses. The following example applies to any host with an address range of
ALL : 192.168.0.0/255.255.254.0
ImportantWhen working in the IPv4 address space, the address/prefix length (prefixlen) pair declarations (CIDR notation) are not supported. Only IPv6 rules can use this format.
- [IPv6 address]/prefixlen pair — [net]/prefixlen pairs can also be used as a pattern to control access to a particular group of IPv6 addresses. The following example would apply to any host with an address range of
ALL : [3ffe:505:2:1::]/64
- The asterisk (*) — Asterisks can be used to match entire groups of hostnames or IP addresses, as long as they are not mixed in a client list containing other types of patterns. The following example would apply to any host within the
ALL : *.example.com
- The slash (/) — If a client list begins with a slash, it is treated as a file name. This is useful if rules specifying large numbers of hosts are necessary. The following example refers TCP Wrappers to the
/etc/telnet.hostsfile for all Telnet connections:
in.telnetd : /etc/telnet.hosts
hosts_accessman 5 page for more information.
126.96.36.199.3. Portmap and TCP Wrappers
Portmap's implementation of TCP Wrappers does not support host look-ups, which means
portmapcan not use hostnames to identify hosts. Consequently, access control rules for portmap in
hosts.denymust use IP addresses, or the keyword
ALL, for specifying hosts.
portmapaccess control rules may not take effect immediately. You may need to restart the
portmapto operate, so be aware of these limitations.
EXCEPT. It can be used in both the daemon list and the client list of a rule.
EXCEPToperator allows specific exceptions to broader matches within the same rule.
example.comhosts are allowed to connect to all services except
ALL : .example.com EXCEPT attacker.example.com
hosts.allowfile, clients from the
192.168.0.xnetwork can use all services except for FTP:
ALL EXCEPT vsftpd : 192.168.0.
EXCEPToperators. This allows other administrators to quickly scan the appropriate files to see what hosts are allowed or denied access to services, without having to sort through