TCP Wrapper is an open source host-based ACL (Access Control List) system, which is used to restrict the TCP network services based on the hostname, IP address, network address, and so on. It decides which host should be allowed to access a specific network service. TCP Wrapper was developed by a Dutch programmer and physicist Wietse Zweitze Venema in 1990 at the Eindhoven University of Technology. He maintained it until 1995, and then released it under BSD License in 2001. In this brief guide, I will explain how to restrict access to Linux servers using TCP Wrappers.
Please be aware that TCP Wrapper is not a complete replacement for properly configured firewall. It is just a valuable addition to enhance your Linux server's security. It is recommended to use it in conjunction with a fully configured firewall and other security mechanisms and tools.
Install TCP Wrappers
TCP Wrappers is available in the official repositories of most Linux operating systems.
Depending upon the Linux distribution you use, It can be installed as shown below.
On Arch-based systems:
$ sudo pacman -S tcp_wrappers
On YUM-based systems:
$ sudo yum install tcp_wrappers
On APT-based systems:
$ sudo apt-get install tcp_wrappers
On SUSE/openSUSE systems:
$ sudo zypper in tcp_wrappers
Restrict Access To Linux Servers Using TCP Wrappers
TCP Wrappers implements the access control with the help of two configuration files: /etc/hosts.allow and /etc/hosts.deny. These two access control list files decides whether or not the specific clients are allowed to access your Linux server.
The /etc/hosts.allow file
This file contains the list of allowed or non-allowed hosts or networks. It means that we can both allow or deny connections to network services by defining access rules in this file.
The /etc/hosts.deny file
This file contains the list of hosts or networks that are not allowed to access your Linux server. The access rules in this file can also be set up in /etc/hosts.allow with a 'deny' option.
The typical syntax to define an access rule is:
daemon_list : client_list : option : option ...
- daemon_list - The name of a network service such as SSH, FTP, Portmap etc.
- clients_list - The comma separated list of valid hostnames, IP addresses or network addresses.
- options - An optional action that specifies something to be done whenever a rule is matched.
The syntax is same for both files.
Rules to remember
Before using TCP Wrappers, you need to know the following important rules. Please be mindful that the TCP Wrapper consults only these two files (hosts.allow and hosts.deny).
- The access rules in the /etc/hosts.allow file are applied first. They takes precedence over rules in /etc/hosts.deny file. Therefore, if access to a service is allowed in /etc/hosts.allow file, and a rule denying access to that same service in /etc/hosts.deny is ignored.
- Only one rule per service is allowed in both files (hosts.allow and hosts.deny).
- The order of the rules is very important. Only the first matching rule for a given service will be taken into account. The same applies for both files.
- If there are no matching rules for a service in either files or if neither file exist, then access to the service will be granted to all remote hosts.
- Any changes in either files will come to effect immediately without restarting the network services.
The recommended approach to secure your server
Generally, the best practice to secure a Linux server is to block all incoming connections, and allow only a few specific hosts or networks. To do so, edit /etc/hosts.deny file:
$ sudo vi /etc/hosts.deny
Add the following line. This line refuses connections to ALL services and ALL networks.
Then, edit /etc/hosts.allow file:
$ sudo vi /etc/hosts.allow
and allow the specific hosts or networks of your choice.
sshd: 192.168.43.192 192.168.43.193
Also, you can specify valid hostnames instead of IP address as shown below.
sshd: server1.ostechnix.lan server2.ostechnx.lan
Alternatively, you can do the same by defining all rules (both allow and deny) in /etc/hosts.allow file itself.
Edit /etc/hosts.allow file and add the following lines.
sshd: 192.168.43.192 192.168.43.193 sshd: ALL: DENY
You don't need to specify any rule in /etc/hosts.deny file.
As per above rule, all incoming connections will be denied for all hosts except the two hosts 192.168.43.192, 192.168.43.193.
Now, try to SSH to your Linux server from any hosts except the above hosts, you will get the following error.
ssh_exchange_identification: read: Connection reset by peer
You can verify this from your Linux server's log files as shown below.
$ cat /var/log/secure
Jun 16 19:40:17 server sshd: refused connect from 192.168.43.150 (192.168.43.150)
Similarly, you can define rules for other services, say for example vsftpd, in /etc/hosts.allow file as shown below.
vsftpd: 192.168.43.192 vsftpd: ALL: DENY
Again, you don't need to define any rules in /etc/hosts.deny file. As per the above rule, a remote host with IP address 192.168.43.192 is allowed to access the Linux server via FTP. All other hosts will be denied.
Also, you can define the access rules in different formats in /etc/hosts.allow file as shown below.
sshd: 192.168.43.192 #Allow a single host for SSH service sshd: 192.168.43.0/255.255.255.0 #Allow a /24 prefix for SSH vsftpd: 192.168.43.192 #Allow a single host for FTP vsftpd: 192.168.43.0/255.255.255.0 #Allow a /24 prefix for FTP vsftpd: server1.ostechnix.lan #Allow a single host for FTP
Allow all hosts except a specific host
You can allow incoming connections from all hosts, but not from a specific host. Say for example, to allow incoming connections from all hosts in the 192.168.43 subnet, but not from the host 192.168.43.192, add the following line in /etc/hosts.allow file.
ALL: 192.168.43. EXCEPT 192.168.43.192
In the above case, you don't need to add any rules in /etc/hosts.deny file.
Or you can specify the hostname instead of IP address as shown below.
ALL: .ostechnix.lan EXCEPT badhost.ostechnix.lan
For more details, refer the man pages.
$ man tcpd
- Allow Or Deny SSH Access To A Particular User Or Group In Linux
- Limit The Number Of SSH Logins Per User/Group/System
Again, let us not forget, TCP Wrapper is not a replacement for a firewall. It should be used in conjunction with firewalls and other security tools.