tcp_wrappers

• tcp_wrappers的服务访问流程

  
  tcp_wrappers服务访问流程
  tcp_wrappers工作流

• Three stages of access checking
  ~ Is jaccess explicitly permitted ?
  ~ Otherwise, is access explicitly denied ?
  ~ Otherwise, by default, permit access !

• Configuration stored in two files: 配置立即生效，无需重启
  ~ Permissions in /etc/hosts.allow
  ~ Denials in /etc/hosts.deny

• Basic sytax:
  daemon_list: client_list[: options]
  daemon@host: client_list

例子
vsftpd, sshd: 192.168.0.0/255.255.255.0
vsftpd: 192.168.1.1, 192.168.1.2
vsftpd@192.168.0.1: 192.168.0.0/255.255.255.0
sshd@192.168.0.3: 192.168.0.     表示一个C，/24

• 处理流程
  hosts.allow --> hosts.deny --> permit by default

• 查看服务是否支持tcp_wrappers

ldd /usr/sbin/sshd | grep libwrap
libwrap.so.0 => /lib64/libwrap.so.0 (0x00007f1df506e000)

• 帮助

man hosts.allow
man hosts.deny
man hosts_access
man hosts_options