1. Linux Security Configuration TCP Wrappers

2. At the machine level Check Request Server

3. What checks the request? External Firewalls (not here) Hosts Allow/Deny Individual servers Firewall software –ipchains –iptables –shorewall

4. (X)inetd based requests Compare against “host” files inetd Server non-inetd Server

5. How does it check? hosts.allow hosts.deny lockd: 192.168.0.1, 192.168.0.2 rquotad: 192.168.0.1, 192.168.0.2 mountd: 192.168.0.1, 192.168.0.2 statd: 192.168.0.1, 192.168.0.2 lockd: ALL mountd: ALL statd: ALL FIRST Check to see if it is allowed. If so pass to server. SECOND Check to see if it is denied. If so do NOT pass to server. LAST If not Allowed OR denied, then pass to server

6. What does this affect? Remember ONLY those services launched by (X)inetd. And even THEN only those wrapped in TCPwrappers. Services launched at boot/etc are NOT affected.

7. Recent Development Portmapper

8. RPC portmapper Portmapper is a program which handles remote procedure calls. Functions similar to inetd except that it handles RPC calls. Portmapper now uses hosts.allow and hosts.deny nfs related services (previously shown) are the ones most likely impacting you.