By using TCP wrappers you can control the accepting or denying of incoming connections from
specified servers and networks. You may use this capability to protect your network in conjunction with a firewall. In the following recipe, we will allow connections opened through ssh only from the nodeorcl5 host and deny from all others by using TCP wrappers.
TCP wrappers at host level are
controlled by two files located in the /etc directory called hosts.allow and hosts.deny.
- First we will start to deny all incoming connections from all hosts using all services by adding the following line into
/etc/hosts.deny:# hosts.deny This file describes the names of the hosts which are # *not* allowed to use the local INET services, as decided # by the '/usr/sbin/tcpd' server. # # The portmap line is redundant, but it is left to remind you that # the new secure portmap uses hosts.deny and hosts.allow. In particular # you should know that NFS uses portmap! ALL:ALL ................................................................
- In this moment if we try to establish a connection from
nodeorcl5it will be denied:[oraclient@nodeorcl5 ~]$ ssh -l oracle nodeorcl1 ssh_exchange_identification: Connection closed by remote host [oraclient@nodeorcl5 .ssh]$ ssh -l oracle nodeorcl1 oracle@nodeorcl1's password: Last login: Sun Aug 12 19:47:21 2012 from nodeorcl5 [oracle@nodeorcl1 ~]$
- To allow incoming connections only with
sshinclude the following in/etc/hosts.allow:# # # hosts.allow This file describes the names of the hosts which are # allowed to use the local INET services, as decided # by the '/usr/sbin/tcpd' server. # sshd: nodeorcl5 ……………………………………………………………………………………
All changes to hosts.deny and hosts.allow takes immediately in effect; hosts.allow has precedence over the hosts.deny file.
The format for rules is composed by a service or daemon, and host name or IP address. In our examples, we denied all services from all hosts and allowed only ssh connections from nodeorcl5.