TCP Wrapper

__NOTOC__Infobox_Software
name = TCP Wrapper

caption =


developer = Wietse Venema
latest_release_version = v0.7.6
operating_system = Unix-like
genre = Security
license = BSD license
website = [ftp://ftp.porcupine.org/pub/security/index.html]

TCP Wrapper is a host-based Networking ACL system, used to filter network access to Internet Protocol servers on (Unix-like) operating systems such as Linux or BSD. It allows host or subnetwork IP addresses, names and/or ident query replies, to be used as tokens on which to filter for access control purposes.

The original code was written by Wietse Venema at the Eindhoven University of Technology, The Netherlands, between 1990 and 1995. As of June 1, 2001 the program is released under its own BSD-style license.

The tarball includes a library named libwrap that implements the actual functionality. Initially, only services that were spawned for each connection from a super-server (such as inetd) got "wrapped", utilizing the tcpd program. However most common network service daemons today can be linked against libwrap directly. This is used by daemons that operate without being spawned from a super-server, or when a single process handles multiple connections. Otherwise, only the first connection attempt would get checked against its ACLs.

When compared to host access control directives often found in daemons' configuration files, TCP Wrappers have the benefit of runtime ACL reconfiguration (i.e. services don't have to be reloaded or restarted) and a generic approach to network administration.

This makes it easy to use for anti-Worm scripts, such as BlockHosts, DenyHosts or Fail2ban, to add and expire client-blocking rules, when excessive connections and/or many failed login attempts are encountered.

While originally written to protect TCP and UDP accepting services, examples of usage to filter on certain ICMP packets (such as 'pingd' – the userspace ping request responder) exist too.

1999 Trojan

In January 1999, the distribution package at Eindhoven university (the primary distribution site) was replaced by a modified version. The replacement contained a trojaned version of the software that would allow the intruder access to any server that it was installed on. The trojaned version was spotted within hours and the original was restored. [ [http://www.cert.org/advisories/CA-1999-01.html CERT/CC Advisory] ] ManyWho? claim it was spotted so quickly due to its open source nature.Fact|date=August 2008

See also

*DNSBL
*Forward Confirmed reverse DNS
*Firewall
*IP blocking
*Nullroute

References

*Wietse Venema: [http://www.vtcif.telstra.com.au/pub/docs/security/tcp_wrapper.txt TCP WRAPPER Network monitoring, access control, and booby traps.] July 15 1992
*Lee Brotzman: [http://www.linuxjournal.com/article/2180 Wrap a Security Blanket Around Your Computer] Linuxjournal article 1997-08-01

External links

* [http://itso.iu.edu/TCP_Wrappers ITSO: TCP Wrappers overview]
* [http://docs.hp.com/en/5991-4837 HP: TCP Wrappers Information]
* [http://www.softpanorama.org/Net/Network_security/TCP_wrappers/index.shtml Softpanorama TCP Wrappers Information]
* [http://artofhacking.com/files/phrack/phrack52/P52-07.TXT Example of 'pingd' with libwrap support]
* [http://www.360is.com/03-tcpwrappers.htm A laymans guide to TCP Wrappers and its history]