NAME    [Toc]    [Back]

     tcpd - tcp wrappers access  control  facility  for  internet
services

DESCRIPTION    [Toc]    [Back]

     The  tcpd program can be set up to monitor incoming requests
for
     telnet(1), finger(1), ftp(1), rsh(1), tftp(1), talk(1), comsat(8), and
     other  services  that  have  a  one-to-one mapping onto executable files.

     Operation is as follows: whenever a request for service  arrives, the
     inetd(8) daemon is tricked into running the tcpd program instead of the
     desired server.  tcpd logs the request and does  some  additional checks.
     When  all  is well, tcpd runs the appropriate server program
and goes away.

     Optional features are: pattern-based access control,  client
username
     lookups  with  the RFC 931 etc. protocol, protection against
hosts that
     pretend to have someone else's  host  name,  and  protection
against hosts
     that pretend to have someone else's network address.

LOGGING    [Toc]    [Back]

     Connections  that are monitored by tcpd are reported through
the syslog(3)
     facility.  Each record contains a  time  stamp,  the  client
host name and
     the  name  of the requested service.  The information can be
useful to detect
 unwanted activities, especially when  logfile  information from several
 hosts is merged.

     In  order to find out where your logs are going, examine the
syslog configuration
 file, usually /etc/syslog.conf.

ACCESS CONTROL    [Toc]    [Back]

     Optionally, tcpd supports a simple form  of  access  control
that is based
     on  pattern  matching.  The access-control software provides
hooks for the
     execution of shell commands when a pattern fires.   For  details, see the
     hosts_access(5) manual page.

HOST NAME VERIFICATION    [Toc]    [Back]

     The  authentication scheme of some protocols (rsh(1)) relies
on host
     names.  Some implementations believe the host name that they
get from any
     random  name  server; other implementations are more careful
but use a
     flawed algorithm.

     tcpd verifies the client host name that is returned  by  the
address->name
     DNS  server by looking at the host name and address that are
returned by
     the name->address DNS server.  If any discrepancy is detected, tcpd concludes
  that it is dealing with a host that pretends to have
someone elses
     host name.

HOST ADDRESS SPOOFING    [Toc]    [Back]

     Optionally, tcpd disables source-routing socket  options  on
every connection
  that  it  deals with.  This will take care of most attacks from hosts
     that pretend to have an  address  that  belongs  to  someone
else's network.
     UDP services do not benefit from this protection.  This feature must be
     turned on at compile-time.

RFC 931    [Toc]    [Back]

     When RFC 931 etc. lookups are enabled (compile-time  option)
tcpd will attempt
  to  establish the name of the client user.  This will
succeed only
     if the client host runs an RFC 931-compliant daemon.  Client
user name
     lookups will not work for datagram-oriented connections, and
may cause
     noticeable delays in the case of connections from PCs.

FILES    [Toc]    [Back]

     The default locations of the host access control tables are:

     /etc/hosts.allow  Access control table (allow list)
     /etc/hosts.deny   Access control table (deny list)

EXAMPLES    [Toc]    [Back]

     This example applies when tcpd expects that the network daemons are left
     in their original place, as it is configured within OpenBSD.

     In order to monitor access to the finger(1) service, perform
the following
   edits   on   the    inetd(8)    configuration    file,
/etc/inetd.conf:

           finger  stream  tcp  nowait  nobody  /usr/libexec/fingerd  fingerd

     becomes:

           finger  stream  tcp  nowait  nobody  /usr/libexec/tcpd
fingerd

     Similar  changes  will be needed for the other services that
are to be covered
 by tcpd.  Send a `kill -HUP' to the inetd(8) process to
make the
     changes effective.

     In the case of daemons that do not live in a common directory ("secret"
     or otherwise), edit the inetd(8) configuration file so  that
it specifies
     an absolute path name for the process name field.  For example:

         ntalk   dgram   udp    wait    root    /usr/libexec/tcpd
/usr/local/lib/ntalkd

     Only  the  last  component  (ntalkd) of the pathname will be
used for access
     control and logging.

SEE ALSO    [Toc]    [Back]

     hosts_access(5), inetd.conf(5), syslog.conf(5)

AUTHORS    [Toc]    [Back]

           Wietse Venema ([email protected]),
           Department of Mathematics and Computing Science,
           Eindhoven University of Technology
           Den Dolech 2, P.O. Box 513,
           5600 MB Eindhoven, The Netherlands

BUGS    [Toc]    [Back]

     Some UDP (and RPC) daemons linger around for a  while  after
they have finished
  their work, in case another request comes in.  In the
inetd configuration
 file these services are registered with the wait option.  Only
     the request that started such a daemon will be logged.

     RPC  broadcast  requests  (for  example:  rwall(1),  rup(1),
rusers(1)) always
     appear to come from the responding host.   What  happens  is
that the client
     broadcasts the request to all portmap(8) daemons on its network; each
     portmap(8) daemon forwards the request to  a  local  daemon.
As far as the
     rwalld(8)  etc. daemons know, the request comes from the local host.

OpenBSD     3.6                           June      23,      1997