ServerBuddies Support Blog

Securing Services With TCP Wrappers and xinetd

TCP wrappers provide access control to a variety of services. Most modern network services, such as SSH, Telnet, and FTP, make use of TCP wrappers, which stand guard between an in-coming request and the requested service.

The benefits offered by TCP wrappers are enhanced when used in conjunction with xinetd, a super service that provides additional access, logging, binding, redirection, and resource utilization control.

For a thorough list of TCP wrapper functionality and control language, refer to the hosts_options man page.

To implement a TCP wrappers banner for a service, use the banner option.

This example implements a banner for vsftpd. To begin, create a banner file. It can be any-where on the system, but it must bear same name as the daemon. For this example, the file is called /etc/banners/vsftpd.

The contents of the file look like this:

The %c token supplies a variety of client information, such as the username and hostname, or the username and IP address to make the connection even more intimidating.

For this banner to be presented to incoming connections, add the following line to the /etc/hosts.allow file:

The visudo command.

The sudo command also provides a comprehensive audit trail. Each successful authentication is
logged to the file /var/log/messages and the command issued along with the issuer’s user name
is logged to the file /var/log/secure.

Another advantage of the sudo command is that an administrator can allow different users access to specific commands based on their needs.

Administrators wanting to edit the sudo configuration file, /etc/sudoers, should use the visudo
command.

To give someone full administrative privileges, type visudo and add a line similar to the following in the user privilege specification section:

and then

This example states that the user, admin, can use sudo from any host and execute any command.

The example below illustrates the granularity possible when configuring sudo:

This example states that any user can issue the command /sbin/shutdown -h now as long as it is issued from the console.

The sudoers file should always be edited by the visudo command which locks the file and does grammatical checking. It is imperative that sudoers be free of syntax errors since sudo will not run with a syntactically incorrect sudoers file.

The sudo Command

The sudo command offers another approach to giving users administrative access.

When trusted users precede an administrative command with sudo, they are prompted for their own password.

Then, once authenticated and assuming that the command is permitted, the administrative command is executed as if by the root user.

The basic format of the sudo command is as follows:

In the above example, command would be replaced by a command normally reserved for the root user, such as mount.

The sudo command allows for a high degree of flexibility. For instance, only users listed in the /etc/sudoers configuration file are allowed to use the

sudo command and the command is executed in the user’s shell, not a root shell.

Example from /etc/sudoers

# Members of the admin group may gain root privileges

Disabling Root Using PAM

PAM, through the /lib/security/pam_listfile.so module, allows great flexibility in denying specific accounts.

This allows the administrator to point the module at a list of users who are not allowed to log in.

Below is an example of how the module is used for the vsftpd FTP server in the /etc/pam.d/vsftpd PAM configuration file (the \ character at the end of the first line in the following example is not necessary if the directive is on one line):

This tells PAM to consult the file /etc/vsftpd.ftpusers and deny access to the service for any user listed. The administrator is free to change the name of this file, and can keep separate lists for each service or use one central list to deny access to multiple services.

Limiting Root Access

Rather than completely deny access to the root user, the administrator may want to allow ac-cess only via setuid programs, such as su or sudo.

Upon typing the su command, the user is prompted for the root password and, after authentica-tion, is given a root shell prompt.

Once logged in via the su command, the user is the root user and has absolute administrative access to the system. In addition, once a user has become root, it is possible for them to use the su command to change to any other user on the system without being prompted for a password.

Because this program is so powerful, administrators within an organization may wish to limit who has access to the command.

One of the simplest ways to do this is to add users to the special administrative group called wheel. To do this, type the following command as root:

In the previous command, replace with the username you want to add to the wheel group.

You can also try using the command prompt for this, type the command system-config-users at a shell prompt.

Select the Users tab, select the user from the user list, and click Properties from the button menu (or choose File => Properties from the pull-down menu).

Then select the Groups tab and click on the wheel group.

Next, open the PAM configuration file for su (/etc/pam.d/su) in a text editor and remove the comment # from the following line:

Doing this permits only members of the administrative group wheel to use the program.