By default Red Hat Linux allows all service requests. Using TCP_WRAPPERS makes securing your servers against outside intrusion is a lot simpler and painless then you would expect. Deny all hosts by
putting ALL: ALL@ALL, PARANOID in the /etc/hosts.deny file and explicitly list trusted hosts who are allowed to your machine in the /etc/hosts.allow file. This
is the safest and the best configuration. TCP_WRAPPERS is controlled from two files and the search stops at the first match.
/etc/hosts.allow
|
/etc/hosts.deny
|
Access will be granted when a daemon, client pair matches an entry in the /etc/hosts.allow file.
Otherwise, access will be denied when a daemon, client pair matches an entry in the /etc/hosts.deny file.
Otherwise, access will be granted.
Edit the
hosts.denyfile vi/etc/hosts.denyand add the following lines: Access is denied by default.# Deny access to everyone. ALL: ALL@ALL, PARANOID # Matches any host whose name does not match its address, see below.Which means all services, all locations, so any service not explicitly allowed is then blocked, unless they are permitted access by entries in the allow file.
With the parameter PARANOID; If you intend to run telnet or ftp services on your server, dont forget to add the client's machine name and IP address in your
/etc/hostsfile on the server or you can expect to wait several minutes for the DNS lookup to time out, before you get a login: prompt.Edit the
hosts.allowfile vi/etc/hosts.allowand add for example, the following line: The explicitly authorized host are listed in the allow file. As an example:sshd:208.164.186.1 gate.openna.com, For your client machine:208.164.186.1is the IP address andgate.openna.comthe host name of one of your client allowed using sshd.The tcpdchk program is the
tcpd wrapperconfiguration checker. It examines yourtcp wrapperconfiguration and reports all potential and real problems it can find. After your configuration is done, run the program tcpdchk.[root@deep] /# tcpdchk
Error messages may look like this:
warning: /etc/hosts.allow,
line 6: can't verify hostname: gethostbyname(win.openna.com) failed.
If you receive this kind of error message, check in your DNS configuration file for the existence of this hostname.
If you don't want your systems issue file to be displayed when people log in remotely, you can change the telnet option in your /etc/inetd.conf file to look like:
telnet stream tcp nowait root /usr/sbin/tcpd in.telnetd -h
Adding the -h flag on the end will cause the daemon to not display any system information and just hit the user with a login: prompt. This hack is only necessary if you are using a telnet daemon on
your server instead I recommend you use SSH.