Controlling Access to Servers As delivered by most vendors, UNIX is a friendly and trusting operating system. By default, network services are offered to every other computer on the network. Unfortunately, this practice is not an advisable policy in today’s networked world. While you may want to configure your network server to offer a wide variety of network services to computers on your organization’s internal network, you probably want to restrict the services that your computer offers to the outside world. There are several techniques that you can use to control access to servers that do not provide their own systems for access control. TCP Wrappers, Firewalls, Server Configurations Access Control Lists with TCP Wrappers The TCP Wrappers system is built into modern versions of the inetd program, the SSH server, and many other programs. It is included as a standalone program called tcpd on many Unix systems, but not Solaris 10. TCP Wrappers can be downloaded and installed on your Solaris 10 system. What TCP Wrappers Does The TCP Wrappers system gives the system administrator a high degree of control over incoming TCP connections. The system is invoked after a remote host connects to your computer. It is invoked either through a subroutine library that is linked into the Internet server or through a standalone program started up through inetd. Once running, the TCP Wrappers system performs the following steps: 1. It opens the /etc/hosts.allow file. This file contains access control rules and actions for each protocol. 2. It scans through the file, line by line, until it finds a rule that matches the particular protocol and source host that has connected to the server. 3. It executes the action(s) specified in the rule. If appropriate, control is then turned over to the network server. 4. If no matching action is found, the /etc/hosts.deny file is opened and sequentially read line by line. If a matching line is found, access is denied and the corresponding action is performed. 5. If no match is found in either the /etc/host.allow or the /etc/hosts.deny file, then the connection is allowed by default. If this seems overly complicated to you, you are right. The reason for having two files, /etc/hosts.allow and /etc/hosts.deny, is to allow for backward compatibility with various versions of TCP Wrappers that did not provide for different kinds of actions on each line of the file. These earlier versions simply had a list of allowed hosts for each protocol in the file /etc/hosts.allow and a list of hosts to deny for each protocol in the file /etc/hosts.deny. These days, TCP Wrappers is compiled with the –DPROCESS_OPTIONS option, which causes the advanced rules to be properly interpreted. Unfortunately, as is often the case, the complexity of having two incompatible modes of operation remains to allow for backward compatibility. The actions implemented by TCP Wrappers are quite sophisticated. Specifically 1. Compare the incoming hostname and requested service with an access control list to see if this host or this combination of host and service has been explicitly denied. If either is denied, TCP Wrappers drops the connection. 2. Log the results with syslog. 3. Use the ident protocol to determine the username associated with the incoming connection. 4. Optionally send a “banner” to the connecting client. Banners are useful for displaying legal messages or advisories. 5. Optionally run an auxiliary command, i.e. you can have TCP Wrappers run finger to get a list of users on a computer that is trying to contact yours. 6. Perform a double reverse lookup of the IP address, making sure that the DNS entries for the IP address and hostname match. If they do not, this fact is logged. 7. Transfer control to a “jail” or “sandbox” environment where you study the user’s actions. 8. Pass control of the connection to the “real” network daemon or pass control to some other program that can take further action. The TCP Wrappers system allows you to make up for many deficiencies in other network daemons. You can add logging to services that are not otherwise logged, add sophisticated and easily changeable access control lists, and even substitute different versions of a service daemon depending on the calling host. These are some of the reasons that the TCP Wrappers system has become standard on both free and commercial UNIX offerings in recent years. The TCP Wrappers Configuration Language The TCP Wrappers system has a simple but powerful language and a pair of configuration files that allow you to specify whether incoming connections should be accepted. If TCP Wrappers is compiled with the – DPROCESS_OPTIONS flag, then each line of the /etc/hosts.allow and /etc/hosts.deny files have the following format: daemon_list : client_host_list : option [ : option … … ] Alternatively, if TCP Wrappers is compiled without the –DPROCESS_OPTIONS flag, then each line in the /etc/hosts.allow and /etc/hosts.deny files has the following format: daemon_list : client_host_file [ : shell_command ] in which: daemon_list Specifies the command name, i.e. argv[0], of a list of TCP daemons, e.g. telnetd. More than one daemon can be specified by separating them with blanks or commas. The reserved keyword “ALL” matches all daemons. “ALL EXCEPT” matches all daemons except for the specific one mentioned, e.g. “ALL EXCEPT in.ftpd.” Client_host_list Specifies the hostname or IP address of the incoming connection. More than one host can be specified by separating them with blanks or commas. Incomplete hostnames and IP addresses can be used for wildcarding. You can also use the format username@hostname to specify a particular user on a remote computer, although the remote computer must correctly implement the ident protocol. The keyword ALL matches all clients. option [ : option … … ] Specifies one or more options that are executed for the particular service. shell_command Specifies a command that should be executed if the daemon_list and client_host_list are matched. A shell_command can be specified directly in the /etc/hosts.allow or /etc/hosts,deny file if TCP Wrappers is compiled with the –DPROCESS_OPTIONS flag. If TCP Wrappers is compiled without the –DPROCESS_OPTIONS flag, shell commands must be specified with the spawn option. .