Use TCP-Wrapper to manage Linux services

Article title: use TCP-Wrapper to manage Linux services. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.

Use TCP-Wrapper to manage service profiles

●/Etc/hosts. allow
●/Etc/hosts. deny
Reference File

● Man hosts. allow
● Man hosts. deny
In Linux security settings, security settings are divided into three categories: Kernel Filter, application security settings, and TCP-Wrapper.
TCP-Wrapper is like a service manager. all programs that use (support) TCP-Wrapper can use it to restrict some security control, for example, only those locations can be connected, and those areas cannot be connected. If the connection is allowed, the connection can be connected to related services.
Common TCP-Wrapper services include pop3, sshd, vsftpd, telnet, imap... and other common services.
Process

When the packet arrives at the host, TCP-Wrapper will first refer to hosts. allow. if the service is in hosts. allow, it will be passed first.
In hosts. allow, the service will continue. for details, refer to hosts. deny. if the service is in hosts. deny in this project, it cannot be used. Finally, in case the service is in
If hosts. allow or hosts. deny is not described, you can use it.
Instance: The user can only be connected from the eic.com.tw network segment.

 

# Vi/etc/hosts. deny ___________________________ Sshd: ALL instances T .eic.com.tw :__________________________

This takes effect immediately and does not need to be restarted.
Security policy:
In implementation, all services are deny first, and then open them one by one. Therefore, ALL: ALL will be set in hosts. deny, and then to hosts. allow
Enable the necessary settings. In this example, only the ssh service can be started.

# Vi/etc/hosts. deny _____________________ ALL: ALL :____________________ # Vi/etc/hosts. allow _____________________ Sshd: .eic.com.tw :____________________

In this way, a slightly secure mechanism can be achieved.

[1] [2] Next page