Tcp Wrappers Configuration Files - Red Hat ENTERPRISE LINUX 5 - DEPLOYMENT Deployment Manual

If a client is allowed to connect, TCP Wrappers release control of the connection to the requested
service and take no further part in the communication between the client and the server.
In addition to access control and logging, TCP Wrappers can execute commands to interact with the
client before denying or releasing control of the connection to the requested network service.
Because TCP Wrappers are a valuable addition to any server administrator's arsenal of security tools,
most network services within Red Hat Enterprise Linux are linked to the libwrap.a library. Some
such applications include /usr/sbin/sshd, /usr/sbin/sendmail, and /usr/sbin/xinetd.
Note
To determine if a network service binary is linked to libwrap.a, type the following
command as the root user:
ldd <binary-name> | grep libwrap
Replace <binary-name> with the name of the network service binary.
If the command returns straight to the prompt with no output, then the network service is
not linked to libwrap.a.
The following example indicates that /usr/sbin/sshd is linked to libwrap.a:
[root@myserver ~]# ldd /usr/sbin/sshd | grep libwrap
libwrap.so.0 => /usr/lib/libwrap.so.0 (0x00655000)
[root@myserver ~]#
43.5.1.1. Advantages of TCP Wrappers
TCP Wrappers provide the following advantages over other network service control techniques:
• Transparency to both the client and the wrapped network service — Both the connecting client
and the wrapped network service are unaware that TCP Wrappers are in use. Legitimate users are
logged and connected to the requested service while connections from banned clients fail.
• Centralized management of multiple protocols — TCP Wrappers operate separately from the
network services they protect, allowing many server applications to share a common set of access
control configuration files, making for simpler management.

43.5.2. TCP Wrappers Configuration Files

To determine if a client is allowed to connect to a service, TCP Wrappers reference the following two
files, which are commonly referred to as hosts access files:
• /etc/hosts.allow
• /etc/hosts.deny
When a TCP-wrapped service receives a client request, it performs the following steps:
TCP Wrappers Configuration Files
653