First check whether the system has tcp_wrappers installed
If there is output similar to the above, it means that the tcp_wrappers module has been installed. If it is not displayed, it may not be installed, and you need to install it through yum or rpm tools.
Two limitations of tcp_wrappers firewall
Whether a service in the system uses the tcp_wrappers firewall depends on whether the libwrapped library file is applied to the service. If it is applied, the tcp_wrappers firewall can be used. The system defaults to some services (such as sshd, portmap, sendmail, xinetd, vsftpd, tcpd, etc. ) can use the tcp_wrappers firewall.
Three tcp_wrappers setting rules
The firewall implementation of tcp_wrappers is done through the two files /etc/hosts.allow and /etc/hosts.deny. First, let's take a look at the set format.
service:host(s) [:action]
- service: represents the service name, such as sshd, vsftpd, sendmail, etc.
- host(s): represents the host name or IP address, there can be multiple, such as 192.168.60.78, www.cakin24.net
- action: represents the action, the action to be taken when the condition is met.
Several keywords are shown below.
- ALL: Represents all services or all IPs.
- ALL EXCEPT: All services or all IPs (except those specified).
General rules:
Linux will first determine the /etc/hosts.allow file. If the computer being logged in remotely satisfies the rules set in the file /etc/hosts.allow, the /etc/hosts.deny file will not be used. Conversely, if the rules set in /etc/hosts.allow are not met, the /etc/hosts.deny file will be used. If the hosts.deny rule is met, then the host is restricted from accessing the Linux server. If the settings of hosts.deny are not satisfied, this host can access the Linux server by default.
E.g
ALL:ALL EXCEPT 192.168.0.104 means that any machine except the machine 192.168.0.104 is either allowed or denied when performing all services.
Four applications
The goal of a Linux server on the LAN is to only allow 192.168.0.103 to log in to the system remotely through the SSH service. The settings are as follows:
Add the following rules to the /etc/hosts.allow file:
sshd:192.168.0.103
Add the following rules to the /etc/hosts.deny file:
sshd:all