Stop

As you might have gathered, as your configuration files grow, there's a reasonable chance for making a typographical error. In many cases, this is harmless, but I once had a near miss over a dial-up connection into the back of a Linux router. Unfortunately, the console I was using wasn't set up properly, and I hit an extra carriage return by mistake on the sshd line in hosts.allow. This meant that all SSH access was broken until I spotted it.

To say that the order of the rules with TCP Wrappers is sensitive is a monumental understatement. So, if you decide to mix allow and deny rules in hosts.allow (which I strongly do not recommend), then you should take a moment to check that your allow rules are declared well in advance of your deny rules. Otherwise, you might lose remote access.

Luckily, the modem I dialed into over the Linux router reset as expected within a minute or so. Then, I could dial back in to fix the broken hosts.allow file and circumvent networking altogether before using SSH again. Not too many back door dial-up connections exist any more; however, I was lucky in some respects.

Mixing Up the Configuration Files

As I mentioned, I wouldn't recommend ignoring hosts.deny and putting deny configurations in your hosts.allow file, but if you decided to do so for the sake of convenience, the syntax might look something like this:

sshd : localhost : allow
sshd : 192.168. : allow
sshd : .mydomain.tld : allow
sshd : ALL : deny

I suspect this format harks back to older versions of TCP Wrappers.

Is Your Service Enabled?

Many Linux services almost surreptitiously enable TCP Wrapper usage by default. If you're unsure and the man page doesn't shed any light, then the following command should let you know if you can lock down the software using TCP Wrappers.

# ldd /path-to/software | grep libwrap.so

I've also seen libwrap0.so work in some cases, so you can try that if the first command (just libwrap.so) isn't successful. In many cases, you'll know you've hit the jackpot if any output comes back from that command at all.