Security without firewalls

Gift-WrappedSecurity

Not So Static

You might be surprised that it's possible to go one step further with hosts.deny and trigger commands when a nefarious connection is tracked by TCP Wrappers. In the two examples below, the trailing backslashes indicate continuation lines follow.

This first example means all banned connections are logged nicely to /var/log/tcp-wrappers.log:

ALL : .example.com : spawn (/bin/echo \
   %a from %h triggered an alarm %d >> \
   /var/log/tcp-wrappers.log) : deny

Going one step further, the example in Listing 1 involves further action. Each time a running service port is probed, you can do far more than just log the attack details; instead, you could receive a nicely formatted email. Try it and see if you can add to its functionality.

Listing 1

Send Email on Attack

ALL: ALL: SPAWN (
   echo "\n\TCP Wrappers\: Connection refused\n\By\: $(uname -n)\n\Process\:
         %d (pid %p)\n\User\:%u\n\Host\: %c\n\Date\: $(date)\n\" |
   /usr/bin/mail -s "Connection to %d blocked" chrisbinnie@email.com) &

The SPAWN command has lots of other uses, including communicating the attack to other servers, which would also instantly ban the attacking IP. Be warned, however, that generating email for every illegal service access could bring your mail server down (never mind that your server is being attacked), so use this script with some consideration to prevent creating your own specially crafted Denial of Service tool.

The End

Even though I only looked at TCP Wrappers very briefly, I hope you will agree that they are versatile, sophisticated, and yet surprisingly easy to use. There's little excuse for not using TCP Wrappers in some form for telnet access, and I'd be reluctant to deploy SSH on any server of value without them.

Finally, one outstanding feature is that the configuration files are "live," which means you don't have to stop and start services to refresh changes to the rulesets. This makes scripting around TCP Wrappers very simple and incredibly powerful. Popular packages such as Fail2ban [4] and PortSentry [5] have used them very effectively.

Infos