Using TCP Wrappers to secure Linux

TCP Wrappers can be used to GRANT or DENY access to various services on your machine to the outside network or other machines on the same network. It does this by using simple Access List Rules which are included in the two files /etc/hosts.allow and /etc/hosts.deny .

Let us consider this scenario: A remote machine remote_mc trying to connect to your local machine local_mc using ssh.

When the request from the remote_mc is received by the tcp wrapped service (SSH in this case), it takes the following basic steps:

1. It checks the /etc/hosts.allow file and applies the first rule specified for that service. If it finds a matching rule , it allows the connection. If no rule is found, it moves on to step 2.
2. It checks the /etc/hosts.deny file and if a matching rule is found, it deny's the connection.
   

Points to remember

• Rules in hosts.allow takes precedence over rules in hosts.deny . Which means if a matching rule is found in hosts.allow file, the remote_mc is allowed access to the service even if there is a matching deny rule in hosts.deny file.
• You can have only one rule per service in hosts.allow and hosts.deny file.
• If there are no matching rules in either of the files or if the files don't exist, then the remote_mc is allowed access to the service.
• Any changes to hosts.allow and hosts.deny file takes immediate effect.
  

Rule Syntax
The syntax for both hosts.allow and hosts.deny file takes the following form:

daemon : client [:option1:option2:...]

Where daemon can be a combination of ssh daemon, ftp daemon, portmap daemon and so on. Basically any service which has support for libwrap.a library compiled into it is a good candidate for utilizing the services of TCP Wrappers.

client is a comma separated list of hostnames, host IP addresses, special patterns or special wildcards which identify the hosts effected by that rule.

options is an optional action like say sending mail to the administrator when this rule is matched, log to a particular file and so on. It can be a colon separated list of actions too.

Examples of using TCP Wrappers

I want to allow SSH access to hosts in a particular domain say xyz.com and deny access to all the others. I enter the following rule in the hosts.allow file.

sshd : .xyz.com

... and in the hosts.deny file I include the rule:

sshd : ALL

The next rule denys FTP access to all the hosts in the abc.co.in domain as well as hosts in the 192.168.1.0 network.

#FILE: /etc/hosts.deny
vsftpd : 192.168.1. , .abc.co.in : spawn /bin/echo  `/bin/date` access denied >> /var/log/vsftpd.log : deny

The backslash (\) in the above rule is used to break the line and prevents the failure of the rule due to length.

spawn and deny are options. Spawn launches a shell command as a child process. In the above rule, spawn logs a message to the vsftpd log file each time the rule matches. deny is optional if you are including this rule in the hosts.deny file.

Note: The last line in the files hosts.allow and hosts.deny must be a new line character. Or else the rule will fail.

For example, you can use spawn option to send mail to the admin when ever a deny rule is matched.

Wildcards

You can use wildcards in the client section of the rule to broadly classify a set of hosts. These are the valid wildcards that can be used.

• ALL - Matches everything
• LOCAL - Matches any host that does not contain a dot (.) like localhost.
• KNOWN - Matches any host where the hostname and host addresses are known or where the user is known.
• UNKNOWN - Matches any host where the hostname or host address are unknown or where the user is unknown.
• PARANOID - Matches any host where the hostname does not match the host address.
  

Patterns
You can also use patterns in the client section of the rule . Some examples are as follows:

ALL : .xyz.com

Matches all hosts in the xyz.com domain . Note the dot (.) at the beginning.

ALL : 123.12.

Matches all the hosts in the 123.12.0.0 network. Note the dot (.) in the end of the rule.

ALL : 192.168.0.1/255.255.255.0

IP address/Netmask can be used in the rule.

ALL : *.xyz.com

Asterisk * matches entire groups of hostnames or IP addresses.

sshd : /etc/sshd.deny

If the client list begins with a slash (/), it is treated as a filename. In the above rule, TCP wrappers looks up the file sshd.deny for all SSH connections.

sshd : ALL EXCEPT 192.168.0.15

If the above rule is included in the /etc/hosts.deny file, then it will allow ssh connection for only the machine with the IP address 192.168.0.15 and block all other connections. Here EXCEPT is an operator.

Note: If you want to restrict use of NFS and NIS then you may include a rule for portmap . Because NFS and NIS depend on portmap for their successful working. In addition, changes to portmap rules may not take effect immediately.

Suppose I want to log all connections made to SSH with a priority of emergency. See my previous post to know more on logging. I could do the following:

sshd : .xyz.com : severity emerg

Note: You can use the options allow or deny to allow or restrict on a per client basis in either of the files hosts.allow and hosts.deny

in.telnetd : 192.168.5.5 : deny
in.telnetd : 192.168.5.6 : allow

Shell Commands

As mentioned above, you can couple the rules to certain shell commands by using the following two options.

spawn - This option launches a shell command as a child process. For example, look at the following rule:

sshd : 192.168.5.5 : spawn /bin/echo `/bin/date` from %h >> /var/log/ssh.log : deny

Each time the rule is satisfied, the current date and the clients hostname %h is appended to the ssh.log file.

twist - This is an option which replaces the request with the specified command. For example, if you want to send to the client trying to connect using ssh to your machine, that they are prohibited from accessing SSH, you can use this option.

sshd : client1.xyz.com : twist /bin/echo "You are prohibited from accessing this service!!" : deny

When using spawn and twist, you can use a set of expressions. They are as follows :
%a — The client's IP address.
%A — The server's IP address.

%c — Supplies a variety of client information, such as the username and hostname, or the username and IP address.

%d — The daemon process name.
%h — The client's hostname (or IP address, if the hostname is unavailable).
%H — The server's hostname (or IP address, if the hostname is unavailable).

%n — The client's hostname. If unavailable, unknown is printed. If the client's hostname and host address do not match, paranoid is printed.

%N — The server's hostname. If unavailable, unknown is printed. If the server's hostname and host address do not match, paranoid is printed.

%p — The daemon process ID.

%s — Various types of server information, such as the daemon process and the host or IP address of the server.

%u — The client's username. If unavailable, unknown is printed.

Enhancing the System Prompt - $PS1

If you spend a lot of time remotely logging into several machines, or just have many terminals open using the $PS1 variable can aid in keeping track of the whole mess. Even prevent you from making silly mistakes as root.

For instance if you put:

    PS1="[\[\033[1;31m\]\u\[\033[0m\]@\h \W]\\$ "

at the bottom of your /root/.bashrc file. Every time you are logged in as root, the terminal will look like this:

    [root@hostname root]#

Suppose you have seperate accounts like a developer account, a regular account and remote machines account, then you can use separate colors for each of your accounts like, for developer account (magenta), regular account (blue) and remote machines (green) so you know at a glance which is which without reading every line of output looking for that regular text that blends in.

The actual color code is "1;31" inside the PS1 variable. The 1 says make it bold, and the 31 says the color (red). Other colors are:

1;30 Black
1;32 Green
1;33 Yellow
1;34 Blue
1;35 Magenta
1;36 Cyan
1;37 White

This is just a subset of PS1 variable tricks for more information on enhancing the system prompt, read the article at www-106ibm.com.

Find the number of days elapsed since January 1st

To find out how many days have lapsed since January 1st. There is a easy method in Linux. That is using the cal command. For example, try the following :

$ cal -j 10 2005

      October 2005
Sun Mon Tue Wed Thu Fri Sat
                      274
275 276 277 278 279 280 281
282 283 284 285 286 287 288
289 290 291 292 293 294 295
296 297 298 299 300 301 302
303 304

Since today is October 6th, as of January 1st 2005, 279 days have elapsed. The option -j displays the Julian date.

Configuring Xterm in Linux

Xterm is a terminal which runs in X. In linux when you open xterm, you get a small window with a small - hard to read - font by default. Compared to the ordinary xterm, the gnome-terminal and konsole come loaded with lots of features and are good to view. So why would anybody use an xterm over the other two? The answer lies in its low memory foot print. While konsole takes a whooping 8MB and gnome-terminal over 3MB of memory, you can run xterm under 1MB which makes it blazingly fast even when your computer has only 64MB of RAM.Read more »

Configuring Serial Wheel mouse (Microsoft Intellimouse) in Linux

I own a serial port, Microsoft Intellimouse which I have attached to my PC. But each time I reinstall, linux on the machine, the mouse fails to work. Here I will explain how to configure this mouse to work in Linux.

You can use mouseconfig script (found in Fedora) to configure the mouse. First log in as root and enter the command:

#  mouseconfig

It will ask a few questions like which port the mouse is connected (in my case the serial DOS COM1 port), what kind of mouse it is and so on. Then it creates a character device called /dev/ttyS0 and map it to the COM1 port.

Note: If your mouse is connected to the COM2 port, you have to specify it when asked in the mouseconfig script.

Alternately, you can create a character device using the "mknod" program instead of the mouseconfig script; provided you know the major and minor modes of the device. In the case of /dev/ttyS0, it is 4 and 64 respectively.

# mknod c 4 64 /dev/ttyS0

Now check whether it is working or not by doing :

# cat /dev/ttyS0

... and then moving the mouse. If you see characters being written on the screen, it means the device is working properly.

Now change the relavent section in the /etc/X11/xorg.conf file to get it working in X.

My /etc/X11/xorg.conf file's modified Input section is as follows:

# File: /etc/X11/xorg.conf 
...
Section "InputDevice"
  Identifier  "Mouse0"
  Driver      "mouse"
#   Option      "Protocol" "IMPS/2"
  Option      "Protocol" "IntelliMouse"
#   Option      "Device" "/dev/input/mice"
  Option      "Device" "/dev/ttyS0"
  Option      "ZAxisMapping" "4 5" #For enabling wheel
  Option      "Buttons"  "3"
  Option      "Emulate3Buttons" "no"
EndSection
...

The commented out lines were the default original settings after I installed Fedora core 2; and the lines below it are the settings I have inserted. "IMPS/2" protocol can be used if you have a PS/2 wheel mouse; in which case, you have to change the Device settings too.

Then you restart X.
That is all there is to it. Now you can use your Microsoft Intellimouse to its full potential in linux.

How to play VCD .dat files using mplayer

Mplayer is a versatile piece of GNU/GPLed video/audio software which supports an astronishing variety of audio and video formats. In the previous post, I had explained how to convert a VCD to MP3 format. Here is another tip to help one use mplayer to play a VCD file. As you know a VCD has video files by names avesqrt.dat . To play such files in linux (provided you have mplayer) , do the following :

$ mplayer   vcd://1

If that doesn't work then specify your cdrom (In my case it is /dev/cdrom but it may be different in your case) device as follows:

$ mplayer   -cdrom-device   /dev/cdrom   vcd://1

Note: You should not mount the cdrom for this to work.

To play a DVD

$ mplayer dvd://[title  [start_title]-end_title] [options]

To see a TV channel (Provided you have a TV tuner card)

$ mplayer tv://[channel] [options] 

Convert a VCD (avesqrt.dat) file into mp3 format

There is an easy way to convert VCD (Video CD) file into MP3. What you need are just MPlayer and Lame. MPlayer is used to convert the VCD file to WAV by using the PCM audio output, and then you can convert the WAV file to MP3 by using Lame.

First, you have to convert it to WAV by using the command:

$ mplayer -ao pcm /path/to/vcd/avseq01.dat 

MPlayer will play the VCD file like usual, but with no sound. Just wait until it finished. You'll get a file 'audiodump.wav' that you can convert to MP3 by using the command:

$ lame -h audiodump.wav newfile.mp3

Switch -h is used to get high quality MP3 file, but bigger filesize.