OpenBSD-4.6/libexec/tcpd/tcpd/tcpd.8
.\" $OpenBSD: tcpd.8,v 1.19 2007/05/31 19:19:41 jmc Exp $
.\"
.\" Copyright (c) 1997, Jason Downs. All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\" notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\" notice, this list of conditions and the following disclaimer in the
.\" documentation and/or other materials provided with the distribution.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS
.\" OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
.\" WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
.\" DISCLAIMED. IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT,
.\" INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
.\" (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
.\" SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
.\" CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
.Dd $Mdocdate: May 31 2007 $
.Dt TCPD 8
.Os
.Sh NAME
.Nm tcpd
.Nd tcp wrappers access control facility for internet services
.Sh DESCRIPTION
The
.Nm
program can be set up to monitor incoming requests for
.Xr telnet 1 ,
.Xr finger 1 ,
.Xr ftp 1 ,
.Xr rsh 1 ,
.Xr tftp 1 ,
.Xr talk 1 ,
.Xr comsat 8 ,
and other services that have a one-to-one mapping onto executable files.
.Pp
.\" The program supports both
.\" .Bx 4.3 -style
.\" sockets and System V.4-style
.\" TLI. Functionality may be limited when the protocol underneath TLI is
.\" not an internet protocol.
.\" .Pp
Operation is as follows: whenever a request for service arrives, the
.Xr inetd 8
daemon is tricked into running the
.Nm
program instead of the desired server.
.Nm
logs the request and does some additional checks.
When all is well,
.Nm
runs the appropriate server program and goes away.
.Pp
Optional features are: pattern-based access control, client username
lookups with the RFC 931 etc. protocol, protection against hosts that
pretend to have someone else's host name, and protection against hosts
that pretend to have someone else's network address.
.Sh LOGGING
Connections that are monitored by
.Nm
are reported through the
.Xr syslog 3
facility.
Each record contains a time stamp, the client host name and
the name of the requested service.
The information can be useful to detect unwanted activities,
especially when logfile information from several hosts is merged.
.Pp
In order to find out where your logs are going, examine the syslog
configuration file, usually
.Pa /etc/syslog.conf .
.Sh ACCESS CONTROL
Optionally,
.Nm
supports a simple form of access control that is based on pattern matching.
The access-control software provides hooks for the execution
of shell commands when a pattern fires.
For details, see the
.Xr hosts_access 5
manual page.
.Sh HOST NAME VERIFICATION
The authentication scheme of some protocols
.Pq Xr rsh 1
relies on host names.
Some implementations believe the host name that they get from any random
name server; other implementations are more careful but use a flawed algorithm.
.Pp
.Nm
verifies the client host name that is returned by the address->name DNS
server by looking at the host name and address that are returned by the
name->address DNS server.
If any discrepancy is detected,
.Nm
concludes that it is dealing with a host that pretends to have someone
elses host name.
.\" .Pp
.\" If the sources are compiled with -DPARANOID,
.\" .Nm tcpd
.\" will drop the connection in case of a host name/address mismatch.
.\" Otherwise, the hostname can be matched with the
.\" .Ar PARANOID
.\" wildcard,
.\" after which suitable action can be taken.
.Sh HOST ADDRESS SPOOFING
Optionally,
.Nm
disables source-routing socket options on every connection that it deals with.
This will take care of most attacks from hosts that pretend
to have an address that belongs to someone else's network.
UDP services do not benefit from this protection.
This feature must be turned on at compile-time.
.Sh RFC 931
When RFC 931 etc. lookups are enabled (compile-time option)
.Nm
will attempt to establish the name of the client user.
This will succeed only if the client host runs an RFC 931-compliant daemon.
Client user name lookups will not work for datagram-oriented
connections, and may cause noticeable delays in the case of connections
from PCs.
.Sh FILES
The default locations of the host access control tables are:
.Pp
.Bl -tag -width /etc/hosts.allow -compact
.It Pa /etc/hosts.allow
Access control table (allow list)
.It Pa /etc/hosts.deny
Access control table (deny list)
.El
.\" .Sh EXAMPLES
.\" The details of using
.\" .Nm tcpd
.\" depend on pathname information that was compiled into the program.
.\" .Sh EXAMPLE 1
.\" This example applies when
.\" .Nm tcpd
.\" expects that the original network
.\" daemons will be moved to an "other" place.
.\" .Pp
.\" In order to monitor access to the
.\" .Xr finger 1
.\" service, move the
.\" original finger daemon to the "other" place and install tcpd in the
.\" place of the original finger daemon. No changes are required to
.\" configuration files.
.\" .Bd -unfilled -offset indent
.\" # mkdir /other/place
.\" # mv /usr/etc/in.fingerd /other/place
.\" # cp tcpd /usr/etc/in.fingerd
.\" .Ed
.\" .Pp
.\" The example assumes that the network daemons live in /usr/etc. On some
.\" systems, network daemons live in /usr/sbin or in /usr/libexec, or have
.\" no `in.\' prefix to their name.
.\" .Sh EXAMPLE 2
.Sh EXAMPLES
This example applies when
.Nm
expects that the network daemons
are left in their original place, as it is configured within
.Ox .
.Pp
In order to monitor access to the
.Xr finger 1
service, perform the following edits on the
.Xr inetd 8
configuration file,
.Pa /etc/inetd.conf :
.Bd -unfilled -offset indent
finger stream tcp nowait nobody /usr/libexec/fingerd fingerd
.Ed
.Pp
becomes:
.Bd -unfilled -offset indent
finger stream tcp nowait nobody /usr/libexec/tcpd fingerd
.Ed
.\" .Pp
.\" The example assumes that the network daemons live in /usr/etc. On some
.\" systems, network daemons live in /usr/sbin or in /usr/libexec, the
.\" daemons have no `in.\' prefix to their name, or there is no userid
.\" field in the inetd configuration file.
.Pp
Similar changes will be needed for the other services that are to be
covered by
.Nm tcpd .
Send a `kill -HUP\' to the
.Xr inetd 8
process to make the changes effective.
.\" AIX users may also have to execute the `inetimp\' command.
.\" .Sh EXAMPLE 3
.Pp
In the case of daemons that do not live in a common directory ("secret"
or otherwise), edit the
.Xr inetd 8
configuration file so that it specifies an absolute path name for the process
name field.
For example:
.Bd -unfilled
ntalk dgram udp wait root /usr/libexec/tcpd /usr/local/lib/ntalkd
.Ed
.Pp
Only the last component
.Pq Nm ntalkd
of the pathname will be used for access control and logging.
.Sh SEE ALSO
.Xr hosts_access 5 ,
.Xr inetd.conf 5 ,
.Xr syslog.conf 5
.Sh AUTHORS
.Bd -unfilled -offset indent
Wietse Venema (wietse@wzv.win.tue.nl),
Department of Mathematics and Computing Science,
Eindhoven University of Technology
Den Dolech 2, P.O. Box 513,
5600 MB Eindhoven, The Netherlands
.Ed
.\" @(#) tcpd.8 1.5 96/02/21 16:39:16
.Sh BUGS
Some UDP (and RPC) daemons linger around for a while after they have
finished their work, in case another request comes in.
In the inetd configuration file these services are registered with the
.Ar wait
option.
Only the request that started such a daemon will be logged.
.Pp
.\" The program does not work with RPC services over TCP. These services
.\" are registered as
.\" .Ar rpc/tcp
.\" in the inetd configuration file. The
.\" only non-trivial service that is affected by this limitation is
.\" .Xr rexd 8 ,
.\" which is used by the
.\" .Xr on 1
.\" command. This is no great
.\" loss. On most systems,
.\" .Xr rexd 8
.\" is less secure than a wildcard in
.\" .Pa /etc/hosts.equiv .
.\" .Pp
RPC broadcast requests (for example:
.Xr rwall 1 ,
.Xr rup 1 ,
.Xr rusers 1 )
always appear to come from the responding host.
What happens is that the client broadcasts the request to all
.Xr portmap 8
daemons on its network; each
.Xr portmap 8
daemon forwards the request to a local daemon.
As far as the
.Xr rwalld 8
etc. daemons know, the request comes from the local host.