HOWTO Setup tcpwrappers (tcpd) for controlling access: Difference between revisions
| Line 27: | Line 27: | ||
== Operation == | == Operation == | ||
In use, this will prevent | In use, this will prevent off-campus folks from using SSH, and accessing their home-directories. Typically, on a file-server for example, this is a Good Thing. For Admins, we will have to hit another on-campus box first, then perform a second hop over the the restricted server. | ||
Revision as of 18:45, 26 October 2006
Purpose
TCPWrappers can effectively control access to those services, which have tcpwrapper support compiled in. The controlling daemon is tcpd, which is automatically pulled in whenever the tcpd USE flag in enabled (Gentoo Linux).
Setup
First, verify that SSH has tcpwrapper support (tcpd flag indicates it does, in this example):
hostname ~ # emerge -pv net-misc/openssh [ebuild R ] net-misc/openssh-4.3_p2-r5 USE="ipv6 ldap pam tcpd -X -X509 -chroot -hpn -kerberos -libedit (-selinux) -sftplogging -skey -smartcard -static"
Configure
The goal with SSH and tcpwrappers is to allow anyone within the SFU IP-address range to have access to SSH, and deny everyone else. We'll do this by editing the /etc/hosts.deny file (which won't initially exist, but once created - it will be in effect. There is no need to re-start the sshd daemon, because hosts.deny is consulted on each connect-attempt, and is therefore immediately in-effect after saving). Here's an example:
# /etc/hosts.deny This file describes the names of the hosts which are # *not* allowed to use the specified services, as decided # by the '/usr/sbin/tcpd' server. # Authour: Gordon Pritchard <gordonp@sfu.ca> # We want SSH only from on-campus machines; deny everyone else sshd : 142.58. : ALLOW sshd : ALL : DENY # End of hosts.deny
Operation
In use, this will prevent off-campus folks from using SSH, and accessing their home-directories. Typically, on a file-server for example, this is a Good Thing. For Admins, we will have to hit another on-campus box first, then perform a second hop over the the restricted server.