Restrict Access To Linux Servers Using TCP Wrappers

TCP Wrapper is an open source host-based ACL (Access Control List) system, which is used to restrict the TCP network services based on the hostname, IP address, network address, and so on. It decides which host should be allowed to access a specific network service. TCP Wrapper was developed by a Dutch programmer and physicist Wietse Zweitze Venema in 1990 at the Eindhoven University of Technology. He maintained it until 1995, and then released it under BSD License in 2001. In this brief guide, I will explain how to restrict access to Linux servers using TCP Wrappers.

Please be aware that TCP Wrapper is not a complete replacement for properly configured firewall. It is just a valuable addition to enhance your Linux server’s security. It is recommended to use it in conjunction with a fully configured firewall and other security mechanisms and tools.

Install TCP Wrappers

TCP Wrappers is available in the official repositories of most Linux operating systems.

Depending upon the Linux distribution you use, It can be installed as shown below.

On YUM-based systems:

sudo yum install tcp_wrappers

On APT-based systems:

sudo apt-get install tcp_wrappers

On SUSE/openSUSE systems:

sudo zypper in tcp_wrappers

Restrict Access To Linux Servers Using TCP Wrappers

Configuration

TCP Wrappers implements the access control with the help of two configuration files: /etc/hosts.allow and /etc/hosts.deny. These two access control list files decides whether or not the specific clients are allowed to access your Linux server.

The /etc/hosts.allow file

This file contains the list of allowed or non-allowed hosts or networks. It means that we can both allow or deny connections to network services by defining access rules in this file.

The /etc/hosts.deny file

This file contains the list of hosts or networks that are not allowed to access your Linux server. The access rules in this file can also be set up in /etc/hosts.allow with a ‘deny’ option instead.

The typical syntax to define an access rule is:

daemon_list : client_list : option : option ...

Where,

• daemon_list – The name of a network service such as SSH, FTP, Portmap etc.
• clients_list – The comma separated list of valid hostnames, IP addresses or network addresses.
• options – An optional action that specifies something to be done whenever a rule is matched.

The syntax is same for both files.

Rules to remember

Before using TCP Wrappers, you need to know the following important rules. Please be mindful that the TCP Wrapper consults only these two files (hosts.allow and hosts.deny).

• The access rules in the /etc/hosts.allow file are applied first. They takes precedence over rules in /etc/hosts.deny file. Therefore, if access to a service is allowed in /etc/hosts.allow file, and a rule denying access to that same service in /etc/hosts.deny is ignored.
• Only one rule per service is allowed in both files (hosts.allow and hosts.deny).
• The order of the rules is very important. Only the first matching rule for a given service will be taken into account. This is same for both files.
• If there are no matching rules for a service in either files or if neither file exist, then access to the service will be granted to all remote hosts.
• Any changes in either files will come to effect immediately without restarting the network services.

The recommended approach to secure your server

Generally, the best practice to secure a Linux server is to block all incoming connections, and allow only a few specific hosts or networks. To do so, edit /etc/hosts.deny file:

sudo vi /etc/hosts.deny

Add the following line. This line refuses connections to ALL services and ALL networks.

ALL: ALL

Then, edit /etc/hosts.allow file:

sudo vi /etc/hosts.allow

and allow the specific hosts or networks of your choice.

sshd: 192.168.43.192 192.168.43.193

Also, you can specify valid hostnames instead of IP address as shown below.

sshd: server1.ostechnix.lan server2.ostechnx.lan

Alternatively, you can do the same by defining all rules (both allow and deny) in /etc/hosts.allow file itself.

Edit /etc/hosts.allow file and add the following lines.

sshd: 192.168.43.192 192.168.43.193
sshd: ALL: DENY

You don’t need to specify any rule in /etc/hosts.deny file.

As per above rule, all incoming connections will be denied for all hosts except the two hosts 192.168.43.192, 192.168.43.193.

Now, try to SSH to your Linux server from any hosts except the above hosts, you will get the following error.

ssh_exchange_identification: read: Connection reset by peer

You can verify this from your Linux server’s log files as shown below.

cat /var/log/secure

Sample output:

Jun 16 19:40:17 server sshd[15782]: refused connect from 192.168.43.150 (192.168.43.150)

Similarly, you can define rules for other services, say for example vsftpd, in /etc/hosts.allow file as shown below.

vsftpd: 192.168.43.192 
vsftpd: ALL: DENY

Again, you don’t need to define any rules in /etc/hosts.deny file. As per the above rule, a remote host with IP address 192.168.43.192 is allowed to access the Linux server via FTP. All other hosts will be denied.

Also, you can define the access rules in different formats in /etc/hosts.allow file as shown below.

sshd: 192.168.43.192    #Allow a single host for SSH service
sshd: 192.168.43.0/255.255.255.0  #Allow a /24 prefix for SSH
vsftpd: 192.168.43.192    #Allow a single host for FTP
vsftpd: 192.168.43.0/255.255.255.0         #Allow a /24 prefix for FTP
vsftpd: server1.ostechnix.lan                   #Allow a single host for FTP

Allow all hosts except a specific host

You can allow incoming connections from all hosts, but not from a specific host. Say for example, to allow incoming connections from all hosts in the 192.168.43 subnet, but not from the host 192.168.43.192, add the following line in /etc/hosts.allow file.

ALL: 192.168.43. EXCEPT 192.168.43.192

In the above case, you don’t need to add any rules in /etc/hosts.deny file.

Or you can specify the hostname instead of IP address as shown below.

ALL: .ostechnix.lan EXCEPT badhost.ostechnix.lan

For more details, refer the man pages.

man tcpd