1 简述
TCP wrappers is a simple tool to block incoming connection on application level. This was very useful 20 years ago, when there were no firewalls in Linux. This is not the case for today and connection filtering should be done in network level or completely in application scope if it makes sense. After recent discussions I believe it is time to go for this package, if not completely, than at least as a dependency of modern daemons in system by default.
2 详细描述
The last version of tcp_wrappers was released 20 years ago (although IPv6 support was added later). At that time it was very powerful tool to "block all traffic", but these days we can do the same thing using firewalls/iptables/nftables for all traffic on network level or use similar filtering at the application level.
One of the motivating factors for this change was the removal of TCP wrappers support from systemd and OpenSSH in 2014, based on the thread on fedora devel list [1]. Another thread was started during 2017 [2] which is trying to explain the reasons why we should do that with other constructive ideas.
Another factor which has driven the deprecation of this package is the lack of any upstream community around it. Although the threats on networking communications continually increase, the threat coverage of this package has remained the same over the last two decades, leading one to draw the inference that new threats are now being handled by different components.
3 Upgrade/compatibility impact
Updating from older versions might expose existing services "protected" by tcp_wrappers before (sshd). The removal needs to be explicitly mentioned in the migration guide/release notes so the users are able to configure different layer of security (firewalld, application configuration) if this was the only one they used.
four Migration to tcpd
After removing the libwrap dependency from openssh, it will stop using rules defines in /etc/hosts.deny. The functionality can be "added back" if needed to any socket-activated service. For example SSHD:
- Disable
sshd.service
systemctl disable sshd
- Copy the shipped
[email protected]to/etc:
cp {/usr/lib,/etc}/systemd/system/[email protected]
- Modify the
ExecStartline in the above file under/etc/from
ExecStart=-/usr/sbin/sshd -i $OPTIONS $CRYPTO_POLICY
to
ExecStart=@-/usr/sbin/tcpd /usr/sbin/sshd -i $OPTIONS $CRYPTO_POLICY
- Reload
systemctl
systemctl daemon-reload
- Enable and start
sshd.socket
systemctl enable sshd.socket systemctl start sshd.socket
- Verify that you can connect to new service (not working now, because it is blocked by SELinux). Blocked by the bug #1482554 [3].
A similar approach can be used for other services to drop the tcp_wrappers dependency.
参考链接：
https://fedoraproject.org/wiki/Changes/Deprecate_TCP_wrappers
https://serverfault.com/questions/869431/openssh-removed-support-for-tcp-wrappers-now-what-no-hosts-allow-for-ssh-acce
https://lists.fedoraproject.org/archives/list/[email protected]/message/UOAUI4TC6PQVHRJ2ONQ2N3IKHR4577VH/ 废弃后如何实现原有功能
The last version of tcp_wrappers was released 20 years ago (although IPv6 support was added later). At that time it was very powerful tool to "block all traffic", but these days we can do the same thing using firewalls/iptables/nftables for all traffic on network level or use similar filtering at the application level.
One of the motivating factors for this change was the removal of TCP wrappers support from systemd and OpenSSH in 2014, based on the thread on fedora devel list [1]. Another thread was started during 2017 [2] which is trying to explain the reasons why we should do that with other constructive ideas.
Another factor which has driven the deprecation of this package is the lack of any upstream community around it. Although the threats on networking communications continually increase, the threat coverage of this package has remained the same over the last two decades, leading one to draw the inference that new threats are now being handled by different components.