14.6 TCP Wrappers

Written by: Tom Rhodes.

¨C­Ó¼ô inetd(8) ªº¤H´X¥G³£·|Å¥¹L TCP Wrappers ³o­ÓªF¦è¡A¦ý«Ü¤Ö¤H¯à§¹¥þÁA¸Ñ¥¦¦bºô¸ôÀô¹Ò¤Wªº¦n¥Î¦b­þ¡C ¤j¦h¼Æªº¤H³£·|¸Ë¨¾¤õÀð¨Ó«OÅ@ºô¸ô¡AÁöµM¡A¨¾¤õÀð¥Î³~«D±`¼sªx¡A¦ý¨Ã«D¸U¯à¡C ¨Ò¦p¡G­Y¥´ºâ¦^¶Ç¤@¬q¤å¦rµ¹³s½u¨Ó·½ªÌµ¥¤§Ãþªº¡C¦Ó TCP ³nÅé«o¥i¥H°µ¨ì³oÂI¡AÁÙ¦³¨ä¥L§ó¦h¨Æ±¡¡C¦b¥H¤U¬q¸¨¤º¡A§Ú­Ì±NÄ~Äò¤¶²Ð TCP Wrappers ´£¨Ñªº¥\¯à¡A¥H¤Î¤@¨Ç¹ê»Ú¹B¥Îªº¨Ò¤l¡C

TCP Wrappers ¥i¥HÅý inetd ©ÒºÞ²zªº¨C­Ó server daemon ¡A³£·|¦b TCP Wrappers ªº´x´¤¤§¤U¡C³z¹L TCP Wrappers ³oºØ¤è¦¡¥i¥H¤ä´©³s½u¬ö¿ý(logging) ¡B¦^¶Ç¤@¬q¤å¦rµ¹³s½u¨Ó·½ªÌ¡B¥i¥HÅý daemon ¥u±µ¨ü¤º³¡³s½uµ¥µ¥¡C ÁöµM¨ä¤¤³¡¥÷¥\¯à¥Î¨¾¤õÀð¤]¥i¥H°µ¨ì¡A¦ý TCP Wrappers ¤£¥u¬O¼W¥[¤F¤@¼h«OÅ@¡AÁÙ´£¨Ñ¤F¨¾¤õÀð©Ò¿ì¤£¨ìªº¨Æ±¡¡C

µM¦Ó¡A ¥Ñ TCP Wrappers ©Ò´£¨Ñªº³o¨ÇÃB¥~¦w¥þ¥\¯à¡A ¤£À³¸Óµø¬°Àu¨q¨¾¤õÀ𪺴À¥N¤è®×¡CÀ³¸Óµ²¦X TCP Wrappers ¤Î¨¾¤õÀð¡B¨ä¥L¥[±j¦w¥þ±¹¬I¨Ó¤@¨Ö¹B¥Î¤~¹ï¡A³o¼Ë¤~¥i¥H¬°¨t²Î´£¨Ñ¦h¼h¦w¥þ¨¾Å@¡C

¥Ñ©ó³o¨Ç³]©w¬O¥D­n°w¹ï inetd ©Ò´£¨Ñªº¡A©Ò¥H§Ú­Ì«ØÄ³±z¥ý°Ñ¾\ inetd ³]©w ¤@¸`¡C

Note: ÁöµM inetd(8) ©Ò±Ò°Êªºµ{¦¡¨Ã«D¥þ³¡³£¬O¯u¥¿ªº ¡ydaemons¡z¡A¦ý¤@¯ë¨ÓÁ¿¡A§Ú­Ì³£ÁÙ¬O·|ºÙ©I¬°¡ydaemons¡z¡A ¤U­±§Ú­Ì¤´±N¨Ï¥Î³o¦r²´¨Óªí¹F¡C

14.6.1 Initial Configuration

­Y­n¦b FreeBSD ¤¤¨Ï¥Î TCP Wrappers ªº¸Ü¡A¥u­n½T©w inetd ¦b±Ò°Ê®É¡A¦³¦b /etc/rc.conf ¥[¤W -Ww ªº°Ñ¼Æ§Y¥i¡A³o­Ó³]©w¦b¨t²Î¹w³]´N¦³¤F¡C ·íµMÁٻݭn¾A·í­×§ï /etc/hosts.allow ³]©wÀÉ¡A¦ý syslogd(8) ¤´·|¦b¨t²Î log Àɤº¡A¬ö¿ý¬ÛÃö¸ê®Æ¤U¨Ó¡C

Note: FreeBSD ªº TCP Wrappers ¹ê§@¤è¦¡»P¨ä¥L§@·~¨t²Î¤Wªº TCP Wrappers ¤£¤Ó¤@¼Ë¡A¥Ø«e FreeBSD ¤w¸g¼o±ó¤£¥Î /etc/hosts.deny ¡A¦Ó¤@«ß§ï¥Î /etc/hosts.allow¡C

³Ì²³æªº³]©w¤è¦¡¬O¡A¨C­Ó¹ï daemon ªº³s½u³£¥Ñ /etc/hosts.allow ¨Ó¨M©w¬O§_¤¹³\©Î©Úµ´¡C The default configuration in FreeBSD is to allow a connection to every daemon started with inetd. Changing this will be discussed only after the basic configuration is covered.

Basic configuration usually takes the form of daemon : address : action. Where daemon is the daemon name which inetd started. The address can be a valid hostname, an IP address or an IPv6 address enclosed in brackets ([ ]). The action field can be either allow or deny to grant or deny access appropriately. Keep in mind that configuration works off a first rule match semantic, meaning that the configuration file is scanned in ascending order for a matching rule. When a match is found the rule is applied and the search process will halt.

Several other options exist but they will be explained in a later section. A simple configuration line may easily be constructed from that information alone. For example, to allow POP3 connections via the mail/qpopper daemon, the following lines should be appended to hosts.allow:

# This line is required for POP3 connections:
qpopper : ALL : allow

¥[¤W¤W­±³o¦æ¤§«á¡A¥²¶·­«·s±Ò°Ê inetd¡C­«·s±Ò°Êªº¤è¦¡¥i¥H¥Î kill(1) «ü¥O¡A©Î¥´¡y /etc/rc.d/inetd restart ¡z ¨Ó§¹¦¨¡C

14.6.2 Advanced Configuration

TCP Wrappers has advanced options too; they will allow for more control over the way connections are handled. In some cases it may be a good idea to return a comment to certain hosts or daemon connections. In other cases, perhaps a log file should be recorded or an email sent to the administrator. Other situations may require the use of a service for local connections only. This is all possible through the use of configuration options known as wildcards, expansion characters and external command execution. The next two sections are written to cover these situations.

14.6.2.1 External Commands

Suppose that a situation occurs where a connection should be denied yet a reason should be sent to the individual who attempted to establish that connection. How could it be done? That action can be made possible by using the twist option. When a connection attempt is made, twist will be called to execute a shell command or script. An example already exists in the hosts.allow file:

# The rest of the daemons are protected.
ALL : ALL \
        : severity auth.info \
        : twist /bin/echo "You are not welcome to use %d from %h."

This example shows that the message, ¡§You are not allowed to use daemon from hostname.¡¨ will be returned for any daemon not previously configured in the access file. This is extremely useful for sending a reply back to the connection initiator right after the established connection is dropped. Note that any message returned must be wrapped in quote " characters; there are no exceptions to this rule.

Warning: It may be possible to launch a denial of service attack on the server if an attacker, or group of attackers could flood these daemons with connection requests.

Another possibility is to use the spawn option in these cases. Like twist, the spawn implicitly denies the connection and may be used to run external shell commands or scripts. Unlike twist, spawn will not send a reply back to the individual who established the connection. For an example, consider the following configuration line:

# We do not allow connections from example.com:
ALL : .example.com \
	: spawn (/bin/echo %a from %h attempted to access %d >> \
	  /var/log/connections.log) \
	: deny

This will deny all connection attempts from the *.example.com domain; simultaneously logging the hostname, IP address and the daemon which they attempted to access in the /var/log/connections.log file.

Aside from the already explained substitution characters above, e.g. %a, a few others exist. See the hosts_access(5) manual page for the complete list.

14.6.2.2 Wildcard Options

Thus far the ALL example has been used continuously throughout the examples. Other options exist which could extend the functionality a bit further. For instance, ALL may be used to match every instance of either a daemon, domain or an IP address. Another wildcard available is PARANOID which may be used to match any host which provides an IP address that may be forged. In other words, paranoid may be used to define an action to be taken whenever a connection is made from an IP address that differs from its hostname. The following example may shed some more light on this discussion:

# Block possibly spoofed requests to sendmail:
sendmail : PARANOID : deny

In that example all connection requests to sendmail which have an IP address that varies from its hostname will be denied.

Caution: Using the PARANOID may severely cripple servers if the client or server has a broken DNS setup. Administrator discretion is advised.

To learn more about wildcards and their associated functionality, see the hosts_access(5) manual page.

Before any of the specific configuration lines above will work, the first configuration line should be commented out in hosts.allow. This was noted at the beginning of this section.

¥»¤å¤Î¨ä¥L¤å¥ó¡A¥i¥Ñ¦¹¤U¸ü¡Gftp://ftp.FreeBSD.org/pub/FreeBSD/doc/¡C

­Y¦³ FreeBSD ¤è­±ºÃ°Ý¡A½Ð¥ý¾\Ū FreeBSD ¬ÛÃö¤å¥ó¡A¦p¤£¯à¸Ñ¨Mªº¸Ü¡A¦A¬¢¸ß <questions@FreeBSD.org>¡C
Ãö©ó¥»¤å¥óªº°ÝÃD¡A½Ð¬¢¸ß <doc@FreeBSD.org>¡C