TCP Wrapper
Encyclopedia : T : TC : TCP : TCP Wrapper
TCP Wrapper is a host-based network ACL system written by Dr. Wietse Venema, used to filter otherwise (yet) unauthenticated network access to Internet protocol services run on (Unix-like) operating systems such as Linux or BSD. Allowing host or subnetwork IP adresses, names and/or ident query replys, to be used as tokens to filter on for access control purposes. The name Wrapper is a reference to the wrapper design pattern (of the 'tcpd' program included).
The original code was written at the Eindhoven University of Technology, The Netherlands, between 1990 and 1995. After a discussion between Mr. Venema and Theo de Raadt; as of June 1, 2001 the program is released under its own BSD-style license.
The tarball includes a library named libwrap that implements the actual functionality. Initially only services that start from a super-server (such as inetd) got wrapped, utilizing the 'tcpd' program. However most common network service daemons today can be linked against libwrap directly, and thus honor TCP Wrapper ACLs even when in stand-alone operating mode.
Over host access control directives often found in daemons' configuration files TCP Wrappers have the benefit of runtime ACL reconfiguration (i.e. services don't have to be reloaded or restarted) and a generic approach to network administration.
While originally written to protect TCP and UDP accepting services, examples of usage to filter on certain ICMP packets (such as 'pingd' the userspace ping request responder) exist too.
Services that grab the socket after being started by a super-server (for performance reasons on consecutive connects -- usually multithreaded applications such as: Peter Anvin's tftpd and Peter Eriksson's identd), _have_ to be linked against libwrap rather then wrapped (by tcpd, xinetd, or similar) as otherwise only the first connection attempt gets checked against its ACLs.
The project is usually referred to as TCP Wrappers and is named tcp-wrappers in the Gentoo Linux portage package repository. In Gentoo Linux TCP Wrappers is enabled with the 'tcpd' use-flag.
See also
- redirect
References
- Wietse Venema: [TCP WRAPPER Network monitoring, access control, and booby traps.] July 15 1992
- Lee Brotzman: [Wrap a Security Blanket Around Your Computer] Linuxjournal article 1997-08-01
External links
- [ITSO: TCP Wrappers overview]
- [HP: TCP Wrappers Information]
- [Example of 'pingd' with libwrap support]
From Wikipedia, the Free Encyclopedia. Original article here. Support Wikipedia by contributing or donating.
All text is available under the terms of the GNU Free Documentation License See Wikipedia Copyrights for details.