HOWTO Setup tcpwrappers (tcpd) for controlling access: Difference between revisions

From Research
Jump to navigation Jump to search
 
(4 intermediate revisions by the same user not shown)
Line 1: Line 1:
== Purpose ==
== Purpose ==


TCPWrappers can effectively control access to those services, which have tcpwrapper support compiled in.  The controlling daemon is '''tcpd''', which is automatically pulled in whenever the '''tcpd''' USE flag in enabled (Gentoo Linux).
TCPWrappers can effectively control access to services which have tcpwrapper support compiled in.  The controlling daemon is '''tcpd''', which is automatically pulled in whenever the '''tcpd''' USE flag in enabled (Gentoo Linux).


== Setup ==
== Setup ==
In this example, we'll use the SSH (Secure Shell) daemon, because it's one of the first services we want to have secured.<br>


First, verify that SSH has tcpwrapper support (tcpd flag indicates it does, in this example):
First, verify that SSH has tcpwrapper support (tcpd flag indicates it does, in this example):
Line 21: Line 22:
  # We want SSH only from on-campus machines; deny everyone else
  # We want SSH only from on-campus machines; deny everyone else
  sshd : 142.58. : ALLOW
  sshd : 142.58. : ALLOW
sshd : 209.87.56. : ALLOW
  sshd : ALL : DENY
  sshd : ALL : DENY
   
   
Line 27: Line 29:
== Operation ==
== Operation ==


In use, this will prevent people from off-campus from accessing SSH, and their home-directories.  Typically, on a file-server for example, this is a Good Thing.  For Admins, we will have to hit another on-campus box first, then perform a second hop over the the restricted server.
In use, this will prevent off-campus folks from using SSH, and accessing their home-directories.  Typically, on a file-server for example, this is a Good Thing(tm).  For Admins, we will have to hit another on-campus box first, then perform a second hop over the the restricted server.

Latest revision as of 22:30, 26 October 2006

Purpose

TCPWrappers can effectively control access to services which have tcpwrapper support compiled in. The controlling daemon is tcpd, which is automatically pulled in whenever the tcpd USE flag in enabled (Gentoo Linux).

Setup

In this example, we'll use the SSH (Secure Shell) daemon, because it's one of the first services we want to have secured.

First, verify that SSH has tcpwrapper support (tcpd flag indicates it does, in this example):

hostname ~ # emerge -pv net-misc/openssh
[ebuild   R    ] net-misc/openssh-4.3_p2-r5  USE="ipv6 ldap pam tcpd -X -X509 -chroot -hpn -kerberos -libedit (-selinux) -sftplogging -skey -smartcard -static"

Configure

The goal with SSH and tcpwrappers is to allow anyone within the SFU IP-address range to have access to SSH, and deny everyone else. We'll do this by editing the /etc/hosts.deny file (which won't initially exist, but once created - it will be in effect. There is no need to re-start the sshd daemon, because hosts.deny is consulted on each connect-attempt, and is therefore immediately in-effect after saving). Here's an example:

# /etc/hosts.deny    This file describes the names of the hosts which are
#                    *not* allowed to use the specified services, as decided
#                     by the '/usr/sbin/tcpd' server.

# Authour:  Gordon Pritchard <gordonp@sfu.ca>

# We want SSH only from on-campus machines; deny everyone else
sshd : 142.58. : ALLOW
sshd : 209.87.56. : ALLOW 
sshd : ALL : DENY

# End of hosts.deny

Operation

In use, this will prevent off-campus folks from using SSH, and accessing their home-directories. Typically, on a file-server for example, this is a Good Thing(tm). For Admins, we will have to hit another on-campus box first, then perform a second hop over the the restricted server.