.\" $OpenBSD: tcpd.8,v 1.19 2007/05/31 19:19:41 jmc Exp $ .\" .\" Copyright (c) 1997, Jason Downs. All rights reserved. .\" .\" Redistribution and use in source and binary forms, with or without .\" modification, are permitted provided that the following conditions .\" are met: .\" 1. Redistributions of source code must retain the above copyright .\" notice, this list of conditions and the following disclaimer. .\" 2. Redistributions in binary form must reproduce the above copyright .\" notice, this list of conditions and the following disclaimer in the .\" documentation and/or other materials provided with the distribution. .\" .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS .\" OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED .\" WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE .\" DISCLAIMED. IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, .\" INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES .\" (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR .\" SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER .\" CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" .Dd $Mdocdate: May 31 2007 $ .Dt TCPD 8 .Os .Sh NAME .Nm tcpd .Nd tcp wrappers access control facility for internet services .Sh DESCRIPTION The .Nm program can be set up to monitor incoming requests for .Xr telnet 1 , .Xr finger 1 , .Xr ftp 1 , .Xr rsh 1 , .Xr tftp 1 , .Xr talk 1 , .Xr comsat 8 , and other services that have a one-to-one mapping onto executable files. .Pp .\" The program supports both .\" .Bx 4.3 -style .\" sockets and System V.4-style .\" TLI. Functionality may be limited when the protocol underneath TLI is .\" not an internet protocol. .\" .Pp Operation is as follows: whenever a request for service arrives, the .Xr inetd 8 daemon is tricked into running the .Nm program instead of the desired server. .Nm logs the request and does some additional checks. When all is well, .Nm runs the appropriate server program and goes away. .Pp Optional features are: pattern-based access control, client username lookups with the RFC 931 etc. protocol, protection against hosts that pretend to have someone else's host name, and protection against hosts that pretend to have someone else's network address. .Sh LOGGING Connections that are monitored by .Nm are reported through the .Xr syslog 3 facility. Each record contains a time stamp, the client host name and the name of the requested service. The information can be useful to detect unwanted activities, especially when logfile information from several hosts is merged. .Pp In order to find out where your logs are going, examine the syslog configuration file, usually .Pa /etc/syslog.conf . .Sh ACCESS CONTROL Optionally, .Nm supports a simple form of access control that is based on pattern matching. The access-control software provides hooks for the execution of shell commands when a pattern fires. For details, see the .Xr hosts_access 5 manual page. .Sh HOST NAME VERIFICATION The authentication scheme of some protocols .Pq Xr rsh 1 relies on host names. Some implementations believe the host name that they get from any random name server; other implementations are more careful but use a flawed algorithm. .Pp .Nm verifies the client host name that is returned by the address->name DNS server by looking at the host name and address that are returned by the name->address DNS server. If any discrepancy is detected, .Nm concludes that it is dealing with a host that pretends to have someone elses host name. .\" .Pp .\" If the sources are compiled with -DPARANOID, .\" .Nm tcpd .\" will drop the connection in case of a host name/address mismatch. .\" Otherwise, the hostname can be matched with the .\" .Ar PARANOID .\" wildcard, .\" after which suitable action can be taken. .Sh HOST ADDRESS SPOOFING Optionally, .Nm disables source-routing socket options on every connection that it deals with. This will take care of most attacks from hosts that pretend to have an address that belongs to someone else's network. UDP services do not benefit from this protection. This feature must be turned on at compile-time. .Sh RFC 931 When RFC 931 etc. lookups are enabled (compile-time option) .Nm will attempt to establish the name of the client user. This will succeed only if the client host runs an RFC 931-compliant daemon. Client user name lookups will not work for datagram-oriented connections, and may cause noticeable delays in the case of connections from PCs. .Sh FILES The default locations of the host access control tables are: .Pp .Bl -tag -width /etc/hosts.allow -compact .It Pa /etc/hosts.allow Access control table (allow list) .It Pa /etc/hosts.deny Access control table (deny list) .El .\" .Sh EXAMPLES .\" The details of using .\" .Nm tcpd .\" depend on pathname information that was compiled into the program. .\" .Sh EXAMPLE 1 .\" This example applies when .\" .Nm tcpd .\" expects that the original network .\" daemons will be moved to an "other" place. .\" .Pp .\" In order to monitor access to the .\" .Xr finger 1 .\" service, move the .\" original finger daemon to the "other" place and install tcpd in the .\" place of the original finger daemon. No changes are required to .\" configuration files. .\" .Bd -unfilled -offset indent .\" # mkdir /other/place .\" # mv /usr/etc/in.fingerd /other/place .\" # cp tcpd /usr/etc/in.fingerd .\" .Ed .\" .Pp .\" The example assumes that the network daemons live in /usr/etc. On some .\" systems, network daemons live in /usr/sbin or in /usr/libexec, or have .\" no `in.\' prefix to their name. .\" .Sh EXAMPLE 2 .Sh EXAMPLES This example applies when .Nm expects that the network daemons are left in their original place, as it is configured within .Ox . .Pp In order to monitor access to the .Xr finger 1 service, perform the following edits on the .Xr inetd 8 configuration file, .Pa /etc/inetd.conf : .Bd -unfilled -offset indent finger stream tcp nowait nobody /usr/libexec/fingerd fingerd .Ed .Pp becomes: .Bd -unfilled -offset indent finger stream tcp nowait nobody /usr/libexec/tcpd fingerd .Ed .\" .Pp .\" The example assumes that the network daemons live in /usr/etc. On some .\" systems, network daemons live in /usr/sbin or in /usr/libexec, the .\" daemons have no `in.\' prefix to their name, or there is no userid .\" field in the inetd configuration file. .Pp Similar changes will be needed for the other services that are to be covered by .Nm tcpd . Send a `kill -HUP\' to the .Xr inetd 8 process to make the changes effective. .\" AIX users may also have to execute the `inetimp\' command. .\" .Sh EXAMPLE 3 .Pp In the case of daemons that do not live in a common directory ("secret" or otherwise), edit the .Xr inetd 8 configuration file so that it specifies an absolute path name for the process name field. For example: .Bd -unfilled ntalk dgram udp wait root /usr/libexec/tcpd /usr/local/lib/ntalkd .Ed .Pp Only the last component .Pq Nm ntalkd of the pathname will be used for access control and logging. .Sh SEE ALSO .Xr hosts_access 5 , .Xr inetd.conf 5 , .Xr syslog.conf 5 .Sh AUTHORS .Bd -unfilled -offset indent Wietse Venema (wietse@wzv.win.tue.nl), Department of Mathematics and Computing Science, Eindhoven University of Technology Den Dolech 2, P.O. Box 513, 5600 MB Eindhoven, The Netherlands .Ed .\" @(#) tcpd.8 1.5 96/02/21 16:39:16 .Sh BUGS Some UDP (and RPC) daemons linger around for a while after they have finished their work, in case another request comes in. In the inetd configuration file these services are registered with the .Ar wait option. Only the request that started such a daemon will be logged. .Pp .\" The program does not work with RPC services over TCP. These services .\" are registered as .\" .Ar rpc/tcp .\" in the inetd configuration file. The .\" only non-trivial service that is affected by this limitation is .\" .Xr rexd 8 , .\" which is used by the .\" .Xr on 1 .\" command. This is no great .\" loss. On most systems, .\" .Xr rexd 8 .\" is less secure than a wildcard in .\" .Pa /etc/hosts.equiv . .\" .Pp RPC broadcast requests (for example: .Xr rwall 1 , .Xr rup 1 , .Xr rusers 1 ) always appear to come from the responding host. What happens is that the client broadcasts the request to all .Xr portmap 8 daemons on its network; each .Xr portmap 8 daemon forwards the request to a local daemon. As far as the .Xr rwalld 8 etc. daemons know, the request comes from the local host.