Controlling access to network services can be a challenge. Firewalls are
useful for controlling access in and out of a particular network, but they
can be difficult to configure. TCP wrappers and xinetd
control access to services by hostname and IP addresses. In addition,
these tools also include logging and utilization management capabilities
that are easy to configure.
Many modern network services, such as SSH, Telnet, and FTP, make use of
TCP wrappers, a program that is designed to stand
between an incoming request and the requested service. TCP wrappers is
installed by default with a server-class installation of Red Hat Linux,
providing many advantages over running a variety of different services,
each with their own access control methods.
The idea behind TCP wrappers is that, rather than allowing an incoming
client connection to communicate directly with a network service daemon
running as a separate process on a server system, the target of the
request is "wrapped" by another program, allowing a greater degree of
access control and logging of who is attempting to use the service.
The functionality behind TCP wrappers is provided by
libwrap.a, a library that network services, such as
xinetd, sshd, and
portmap, are compiled against. Additional network
services, even networking programs you may write, can be compiled again
libwrap.a to provide this functionality. Red Hat Linux
bundles the necessary TCP wrapper programs and library in the
tcp_wrappers-<version>
RPM file.
When someone attempts to access a network service using TCP wrappers,
a small wrapper program reports the name of the service requested and
the client's host information. The wrapper program does not directly
send any information back to the client, and after the access control
directives are satisfied, the wrapper gets out of the way, not placing
any additional overhead on the communication between the client and
server.
TCP wrappers provide two basic advantages over other network service
control techniques:
The connecting client is unaware that TCP wrappers are
in use. Legitimate users will not notice anything
different, and attackers never receive any additional information
about why their attempted connections failed.
TCP wrappers operate in a manner that is separate from
the applications the wrapper program protects. This
allows many applications to share a common set of configuration
files for simpler management.
