*nix Documentation Project
·  Home
 +   man pages
·  Linux HOWTOs
·  FreeBSD Tips
·  *niX Forums

  man pages->OpenBSD man pages -> tcpd (8)              



NAME    [Toc]    [Back]

     tcpd - tcp wrappers access  control  facility  for  internet

DESCRIPTION    [Toc]    [Back]

     The  tcpd program can be set up to monitor incoming requests
     telnet(1), finger(1), ftp(1), rsh(1), tftp(1), talk(1), comsat(8), and
     other  services  that  have  a  one-to-one mapping onto executable files.

     Operation is as follows: whenever a request for service  arrives, the
     inetd(8) daemon is tricked into running the tcpd program instead of the
     desired server.  tcpd logs the request and does  some  additional checks.
     When  all  is well, tcpd runs the appropriate server program
and goes away.

     Optional features are: pattern-based access control,  client
     lookups  with  the RFC 931 etc. protocol, protection against
hosts that
     pretend to have someone else's  host  name,  and  protection
against hosts
     that pretend to have someone else's network address.

LOGGING    [Toc]    [Back]

     Connections  that are monitored by tcpd are reported through
the syslog(3)
     facility.  Each record contains a  time  stamp,  the  client
host name and
     the  name  of the requested service.  The information can be
useful to detect
 unwanted activities, especially when  logfile  information from several
 hosts is merged.

     In  order to find out where your logs are going, examine the
syslog configuration
 file, usually /etc/syslog.conf.

ACCESS CONTROL    [Toc]    [Back]

     Optionally, tcpd supports a simple form  of  access  control
that is based
     on  pattern  matching.  The access-control software provides
hooks for the
     execution of shell commands when a pattern fires.   For  details, see the
     hosts_access(5) manual page.


     The  authentication scheme of some protocols (rsh(1)) relies
on host
     names.  Some implementations believe the host name that they
get from any
     random  name  server; other implementations are more careful
but use a
     flawed algorithm.

     tcpd verifies the client host name that is returned  by  the
     DNS  server by looking at the host name and address that are
returned by
     the name->address DNS server.  If any discrepancy is detected, tcpd concludes
  that it is dealing with a host that pretends to have
someone elses
     host name.


     Optionally, tcpd disables source-routing socket  options  on
every connection
  that  it  deals with.  This will take care of most attacks from hosts
     that pretend to have an  address  that  belongs  to  someone
else's network.
     UDP services do not benefit from this protection.  This feature must be
     turned on at compile-time.

RFC 931    [Toc]    [Back]

     When RFC 931 etc. lookups are enabled (compile-time  option)
tcpd will attempt
  to  establish the name of the client user.  This will
succeed only
     if the client host runs an RFC 931-compliant daemon.  Client
user name
     lookups will not work for datagram-oriented connections, and
may cause
     noticeable delays in the case of connections from PCs.

FILES    [Toc]    [Back]

     The default locations of the host access control tables are:

     /etc/hosts.allow  Access control table (allow list)
     /etc/hosts.deny   Access control table (deny list)

EXAMPLES    [Toc]    [Back]

     This example applies when tcpd expects that the network daemons are left
     in their original place, as it is configured within OpenBSD.

     In order to monitor access to the finger(1) service, perform
the following
   edits   on   the    inetd(8)    configuration    file,

           finger  stream  tcp  nowait  nobody  /usr/libexec/fingerd  fingerd


           finger  stream  tcp  nowait  nobody  /usr/libexec/tcpd

     Similar  changes  will be needed for the other services that
are to be covered
 by tcpd.  Send a `kill -HUP' to the inetd(8) process to
make the
     changes effective.

     In the case of daemons that do not live in a common directory ("secret"
     or otherwise), edit the inetd(8) configuration file so  that
it specifies
     an absolute path name for the process name field.  For example:

         ntalk   dgram   udp    wait    root    /usr/libexec/tcpd

     Only  the  last  component  (ntalkd) of the pathname will be
used for access
     control and logging.

SEE ALSO    [Toc]    [Back]

     hosts_access(5), inetd.conf(5), syslog.conf(5)

AUTHORS    [Toc]    [Back]

           Wietse Venema (wietse@wzv.win.tue.nl),
           Department of Mathematics and Computing Science,
           Eindhoven University of Technology
           Den Dolech 2, P.O. Box 513,
           5600 MB Eindhoven, The Netherlands

BUGS    [Toc]    [Back]

     Some UDP (and RPC) daemons linger around for a  while  after
they have finished
  their work, in case another request comes in.  In the
inetd configuration
 file these services are registered with the wait option.  Only
     the request that started such a daemon will be logged.

     RPC  broadcast  requests  (for  example:  rwall(1),  rup(1),
rusers(1)) always
     appear to come from the responding host.   What  happens  is
that the client
     broadcasts the request to all portmap(8) daemons on its network; each
     portmap(8) daemon forwards the request to  a  local  daemon.
As far as the
     rwalld(8)  etc. daemons know, the request comes from the local host.

OpenBSD     3.6                           June      23,      1997
[ Back ]
 Similar pages
Name OS Title
tcpd FreeBSD access control facility for internet services
tcpd HP-UX access control facility for internet services
tcpd Linux access control facility for internet services
lomac FreeBSD Low-Watermark Mandatory Access Control security facility
inetd Tru64 Internet services daemon
inetd HP-UX Internet services daemon
services Linux Internet network services list
services Tru64 Defines the sockets and protocols used for Internet services
inetsvcs.conf HP-UX configuration file for secure internet services
inetsvcs_sec HP-UX enable/disable secure internet services
Copyright © 2004-2005 DeniX Solutions SRL
newsletter delivery service