Understanding and Managing TCP Wrappers in Linux

What is TCP Wrappers ?
An important part of maintaining another level of security computer, with TCP Wrappers; you 
     can also restrict access to your system by remote hosts by using list of hosts are kept in the  
                         /etc/hosts.allow and /etc/hosts.deny files.
TCP Wrappers stand guard between an incoming request and the requested service.
 Configuration Files 
When a client connects to a “ tcp wrapped” service, the access control list /etc/hosts.allow and /etc/hosts.deny are examined. The server will then either choose to accept or drop the connection, depending on the control list configuration. Policies can be specified for individual services and are usually configured in terms of the clients IP-Address.Both files have same basic syntax to allow or deny clients list

Service List  :  Client   List

Three stages of access checking

Is access explicitly permitted?

Otherwise, is access is explicitly denied?

Otherwise, by default, permit access!

Configuration stored in two files

Permissions in /etc/hosts.allow

Denials in /etc/hosts.deny 

Examples:

sshd: .example.com

sshd: ALL EXCEPT .rahullinuxtricks.blogspot.in

sshd: ALL EXCEPT .rahullinuxtricks.blogspot.in EXCEPT google.com

ALL EXCEPT sshd: ALL

ALL EXCEPT sshd: ALL EXCEPT .rahullinuxtricks.org

ALL EXCEPT sshd: ALL EXCEPT .rahullinuxtricks.blogspot.in EXCEPT google.com

TCP Wrappers & Attack Warnings
 If a particular host or network has been detected attacking the server, TCP Wrappers can be used to warn the administrator of subsequent attacks from that host or network using the spawn directive.
206.182.68.0/24 network has been detected attempting to attack the server. Place the following line in the /etc/hosts.deny file to deny any connection attempts from that network, and to log the attempts to a special file:

ALL : 206.182.68.0 : spawn /bin/ 'date' %c %d >> /var/log/intruder_alert

The %d token supplies the name of the service that the attacker was trying to access.

To allow the connection and log it, place the spawn directive in the /etc/hosts.allow file. 

TCP Wrappers & Enhanced Logging

If certain types of connections are of more concern than others, the log level can be elevated for that service using the severity option.

Anyone attempting to connect to port 23 (the Telnet port) on an FTP server is a cracker. To denote this, place an emerg flag in the log files instead of the default flag, info, and deny the connection. To do this, place the following line in /etc/hosts.deny:

in.telnetd : ALL : severity emerg

This uses the default authpriv logging facility, but elevates the priority from the default value of info to emerg, which posts log messages directly to the console.