how does tcp wrappers work on gentoo? [Solved]

Bones McCracker · Veteran Joined: 14 Mar 2006 Posts: 1611 Location: U.S.A.

How can I check which services I can control access to with my hosts.allow and hosts.deny files? I see what's listed in documentation as examples of what it can protect, but I want to verify.

Gentoo doesn't have inetd and I don't have xinetd installed. With tcpd installed and the tcpd flag turned on I am able to control access to sshd. And I trust this would also work for other packages with the tcpd flag, such as gdm, gnome-session, and esound).

However, I'm wondering about other binaries that belong to packages not having the tcpd flag and not apparently linked to libwrap.a

For example, there is no tcpd flag for xsm. And yet, xsm depends on net-misc/netkit-rsh, which means I've got rshd on my machines whether I like it or not. So, in the event rshd is activated, would my /etc/hosts.allow and /etc/hosts.deny files control access?

One thing I tried was testing which binaries are linked to libwrap.a. Based on what little I am capable of, it does not appear that rshd is (I checked as follows):

Chris W · Posted: Tue Apr 03, 2007 10:09 pm Post subject:

Given that almost everything is dynamically linked I would gone with this approach to see if a binary is (potentially) using TCP wrappers (libwrap):

Bones McCracker · Veteran Joined: 14 Mar 2006 Posts: 1611 Location: U.S.A.

Thanks, Chris.

This will be very helpful. I think I'll use it to write a little script.

Naib · Posted: Tue Apr 03, 2007 11:00 pm Post subject:

or just list what ebuilds use the "tcpd" USE flag
_________________
#define HelloWorld int
#define Int main()
#define Return printf
#define Print return
#include <stdio>
HelloWorld Int {
Return("Hello, world!\n");
Print 0;

Bones McCracker · Veteran Joined: 14 Mar 2006 Posts: 1611 Location: U.S.A.

Well, I did that first, of course. But that itself is what raised the question. This should demonstrate the thought process I've been through. Where it leaves me currently is concluding that tcpd (at least in my case) is really doing squat, since it provides no protection to the most vulnerable of services, and can be disabled.

Hu · Administrator Joined: 06 Mar 2007 Posts: 23091

Having rshd on the system is not automatically a risk. You only have a problem if someone turns it on. If you are concerned, you could try changing the permissions on rshd to forbid execution.

Chris W · Posted: Thu Apr 05, 2007 5:32 am Post subject:

I would hazard a guess that xsm only uses the client portion of the rsh package in order to launch any remote applications that might be in a session. If this is not something you do then it will not use rsh at all.
_________________
Cheers,
Chris W
"Common sense: The collection of prejudices acquired by age 18." -- Einstein

Bones McCracker · Veteran Joined: 14 Mar 2006 Posts: 1611 Location: U.S.A.

My main question was whether tcp wrappers was providing any benefit.
I decided it's excessively redundant (with firewall and service-specific host-based access controls) in the few cases where it was actually doing anything. None of the old daemons seem to be linked to it. So I removed it.

rshd and the others are fairly well access-controlled by pam, so I'm not that concerned about something starting them up
tftpd is not, though. So I think follow Hu's suggestion and chmod it from 755 to 750.

I'm leaving it on my other machine (which actually provides several more services) as a redundant measure for when I screw up.
Thanks for the comforting second opinion.

wswartzendruber · Posted: Tue Apr 21, 2009 2:17 pm Post subject:

Bones McCracker · Veteran Joined: 14 Mar 2006 Posts: 1611 Location: U.S.A.

Nothing. But it is a redundant layer of protection at the host level, and a certain amount of redundancy is good. Firewalls can be defeated (for example, malware on one of your windows boxes can start an outbound connection that sets up a conntrack entry on the firewall machine which then allows an external host to penetrate it).

One thing I never mentioned was specifically that xinetd (which gentoo does use by default instead of inetd) provides tcpd-like protection for most services. Network access controls are provided for rexec, rlogin, rsh, etc. in /etc/xinetd.d, and network access to these services is denied by default :
/etc/xinetd.d/rsh

wswartzendruber · Posted: Tue Apr 21, 2009 11:07 pm Post subject:

I'm wondering if I even need this given an Apache and PostgreSQL server.
_________________
Git has obsoleted SVN.
10mm Auto has obsoleted 45 ACP.

Bones McCracker · Veteran Joined: 14 Mar 2006 Posts: 1611 Location: U.S.A.

wswartzendruber · Posted: Tue Apr 21, 2009 11:22 pm Post subject:

Bones McCracker · Veteran Joined: 14 Mar 2006 Posts: 1611 Location: U.S.A.

Regarding my own concern with tftpd, it would seem the risk is minimal as tftpd will only handle world-readable or world-writable files.

From tftpd man page:

melinux · n00b Joined: 25 May 2006 Posts: 59 Location: Malta

Is tcp-wrappers on gentoo going to have CIDR format added to it ?
Because that would be very convenient to have.

desultory · Bodhisattva Joined: 04 Nov 2005 Posts: 9410

While there is a bug open requesting the inclusion of patches providing that functionality, there has been no developer activity on that bug for over 2 years, though the package has not been otherwise updated during that time.