Linux under Tcpwraper access control detailed

Linux under Tcpwraper access control detailed

1.tcpwraper Concept: Unlike iptables Firewall network access control, Iptables can do all the access control for TCP/IP and work in the kernel, and tcpwraper only a subset of services with TCP protocol network access control, It is convenient for those unfamiliar with iptables, that is, only those services that link libwraper.so library files are controlled by tcpwraper

2.LDD Command Query service whether to load dynamic libwrap.so library files, if loaded, is controlled by tcpwraper, otherwise uncontrolled

LDD ' which service name ' | grep libwrap

Example: LDd ' which sshd ' | grep libwrap

LDD ' which xinetd ' | grep libwrap

3.strings command query whether to load static Hosts.allow and Host.deny files, if loaded, is controlled by tcpwraper, otherwise uncontrolled

Strings ' Which portmap ' | grep hosts

4.tcpwraper control mechanism: mainly by/etc/hosts.allow and/etc/hosts.deny these two files to control

Match order: First query/etc/hosts.allow, then query/etc/hosts.deny, and finally the default rule is to allow all through

/etc/hosts.allow and/etc/hosts.deny file formats:

Service list: Client list [: Options]

There are several types of service lists:

Sshd

VSFTPD,SSHD,IN.TELNETD #可以写多个服务

All

[Email protected]

There are several types of client-side lists:

Ip

Network/mask (e.g. 172.16.1.0/255.255.255.0)

172.16.1.

FQDN #完整合格域名, such as mail.willow.com

. example.com #域名

All #所有主机

Local,known,unknown,paranoid

EXCEPT #意思是除了

There are several types of options:

Deny #在host can be written in. Allow files

Allow can be written in #在host. Deny file

Spawn #可以在后面执行一样命令

TCP_WRAPER macro Definition:

%c: Represents client information ([email protected])

%s: Representative server information ([email protected])

%H: Client host name (hostname)

%p: Service ID (server PID)

Tcp_wraper macro definition Query method: Man 5 hosts_access

5. Example: Do not allow 1.1.1.0/24 to access the native Telnet service, but allow 1.1.1.100 access, other clients are not controlled

5.1. Method 1:

Vim/etc/hosts.allow

in.telnetd:1.1.1.100

Vim/etc/hosts.deny

in.telnetd:1.1.1.0/255.255.255.0

5.2. Method 2:

Vim/etc/hosts.deny

in.telnetd:1.1.1. EXCEPT 1.1.1.100

5.3. Method 3

Vim/etc/hosts.allow

In.telnetd:ALL EXCEPT 1.1.1. EXCEPT 1.1.1.100

Vim/etc/hosts.deny

In.telnetd:ALL

6. In the Hosts.allow file, denying 1.1.1.0/24 access to the native sshd service is an uncommon notation

Vim/etc/host.allow

sshd:1.1.1. :D Eny

7. Allow 1.1.1.0/24 to access the native sshd service, but must log it in logs

Vim/etc/hosts.allow

sshd:1.1.1. : Spawn echo "' Date ', Login attempt from%c to%s" >>/var/log/tcpwarper.log

This article is from the "Xavier Willow" blog, please be sure to keep this source http://willow.blog.51cto.com/6574604/1788003

Linux under Tcpwraper access control detailed