Sponsored Content
Top Forums UNIX for Advanced & Expert Users TCP Wrappers and restricting users Post 302389059 by Corona688 on Friday 22nd of January 2010 12:22:41 PM
Old 01-22-2010
I'm not too clear on how tcpd would tell the difference between users either, since it would seem to happen before it hands over the connection! Some of its documentation hints about IDENT protocol or RFC931, which could mean having to do custom configuration on the client not just the server. And that probably assumes the username on the client machine matches what they want to login as in the first place.

All in all it would be much better to do it cleanly inside vsftp, but that doesn't look possible either! It does have per-client configuration settings, cheerfully ignored whenever they specify limits on things already happened -- like specifying an IP to connect from. Its user allow/deny list cannot specify IP addresses either, it's just a dumb text file of one user per line.

If you absolutely have to use vsftpd, you might need to set up a separate daemon for that one user, restricted to some internal subnet. Or, if the user's not internal, over some VPN.
 

10 More Discussions You Might Find Interesting

1. Cybersecurity

TCP Wrappers

I have installed TCP wrappers , Good package ... I have a problem with the hosts_options part ... I am not able to use the twist command .. It just dosent respond I have compiled wrappers 7.6 for Solaris 8 with ipv6 support ... Everything works fine except the twist doesnt work I have... (1 Reply)
Discussion started by: DPAI
1 Replies

2. IP Networking

All tcp/ip users are logged out

I have an RS6000 server running AIX and on occasion all users are logged out of the server "connection closed by foreign host" is the error message. Normally a user can press enter and get a Login prompt, but they get the message "connection refused" and then the users can wait a minute or so and... (2 Replies)
Discussion started by: Docboyeee
2 Replies

3. Solaris

restricting users privileges and logging their activities

Hello, I'm administrating new installed cluster that runs Legato Networker and Oracle 9. And I want to restrict the use of root to my self and givr the application and DBA the proper and needed privileges to do their duties without hassle in addition I would like to log users activities. my... (0 Replies)
Discussion started by: sh_ksa
0 Replies

4. Solaris

logging solaris 10 tcp-wrappers

I want to log tcp-wrapper events Solaris 10. I researched and saw that I could make a syslog entry in the hosts.deny, which I did below. After restarting syslog and having ssh blocking, I see nothing logging. I also do not get the email that should be generated. The file was taken from a... (2 Replies)
Discussion started by: csgonan
2 Replies

5. Solaris

TCP Wrappers - again

has anyone ever tried using a client list in thier hosts.allow file Example of hosts.allow) in.ftpd: /etc/ftp.hosts "ftp.hosts" has my list of IP address that are allow access.... However I cant get this work...Any Comments or Help? (0 Replies)
Discussion started by: dodge_man
0 Replies

6. AIX

TCP wrappers

With things installed and wrapping ftpd on AIX 5.1 in hosts.deny I have; ALL: ALL in hosts.allow; ftpd: x.x.x.x ALL: x.x.x.x I get this on connect via ftp; 421 Service not available, remote server has closed connection So its working as far as blocking but the hosts.allow seems to be... (1 Reply)
Discussion started by: traken
1 Replies

7. Shell Programming and Scripting

restricting users

how can i make my users to not use particular commands in the network like:wall....... pl z help me regarding this (1 Reply)
Discussion started by: yashwanthguru
1 Replies

8. Red Hat

Restricting multiple users to run only sftp server

Hello, can someone please provide steps, can I restrict a multiple users to only access only sftp on a server, to perform upload and download of files on their home directories. 1. I have updated their login shell as /sbin/nologin. anything else do I need to update. Thanks, (3 Replies)
Discussion started by: bobby320
3 Replies

9. AIX

aix tcp wrappers hosts.allow hosts.deny?

hi all just installed the netsec.options.tcpwrapper from expansion pack, which used to be a rpm, for my aix 6.1 test box. it is so unpredictable. i set up the hosts.deny as suggested for all and allow the sshd for specific ip addresses/hostnames. the tcpdchk says the hosts allowed and... (0 Replies)
Discussion started by: wf201626
0 Replies

10. AIX

TCP Wrappers on AIX 5.3

Hi, I have in my organization varied OS types (AIX,RHEL,Solaris) My need was to block ftp connections from some addresses on my organization, but to not disable the protocol. In the linux servers i did that with the hosts.deny file that used by the vsftpd deamon. In my AIX servers, i have... (6 Replies)
Discussion started by: moshesa
6 Replies
TCP(4P) 																   TCP(4P)

NAME
tcp - Internet Transmission Control Protocol SYNOPSIS
#include <sys/socket.h> #include <netinet/in.h> s = socket(AF_INET, SOCK_STREAM, 0); DESCRIPTION
The TCP protocol provides reliable, flow-controlled, two-way transmission of data. It is a byte-stream protocol used to support the SOCK_STREAM abstraction. TCP uses the standard Internet address format and, in addition, provides a per-host collection of "port addresses". Thus, each address is composed of an Internet address specifying the host and network, with a specific TCP port on the host identifying the peer entity. Sockets utilizing the tcp protocol are either "active" or "passive". Active sockets initiate connections to passive sockets. By default TCP sockets are created active; to create a passive socket the listen(2) system call must be used after binding the socket with the bind(2) system call. Only passive sockets may use the accept(2) call to accept incoming connections. Only active sockets may use the connect(2) call to initiate connections. Passive sockets may "underspecify" their location to match incoming connection requests from multiple networks. This technique, termed "wildcard addressing", allows a single server to provide service to clients on multiple networks. To create a socket which listens on all networks, the Internet address INADDR_ANY must be bound. The TCP port may still be specified at this time; if the port is not specified the system will assign one. Once a connection has been established the socket's address is fixed by the peer entity's location. The address assigned the socket is the address associated with the network interface through which packets are being transmitted and received. Normally this address corresponds to the peer entity's network. TCP supports one socket option which is set with setsockopt(2) and tested with getsockopt(2). Under most circumstances, TCP sends data when it is presented; when outstanding data has not yet been acknowledged, it gathers small amounts of output to be sent in a single packet once an acknowledgement is received. For a small number of clients, such as window systems that send a stream of mouse events which receive no replies, this packetization may cause significant delays. Therefore, TCP provides a boolean option, TCP_NODELAY (from <netinet/tcp.h>, to defeat this algorithm. The option level for the setsockopt call is the protocol number for TCP, available from getpro- tobyname(3N). Options at the IP transport level may be used with TCP; see ip(4P). Incoming connection requests that are source-routed are noted, and the reverse source route is used in responding. DIAGNOSTICS
A socket operation may fail with one of the following errors returned: [EISCONN] when trying to establish a connection on a socket which already has one; [ENOBUFS] when the system runs out of memory for an internal data structure; [ETIMEDOUT] when a connection was dropped due to excessive retransmissions; [ECONNRESET] when the remote peer forces the connection to be closed; [ECONNREFUSED] when the remote peer actively refuses connection establishment (usually because no process is listening to the port); [EADDRINUSE] when an attempt is made to create a socket with a port which has already been allocated; [EADDRNOTAVAIL] when an attempt is made to create a socket with a network address for which no network interface exists. SEE ALSO
getsockopt(2), socket(2), intro(4N), inet(4F), ip(4P) 4.2 Berkeley Distribution May 16, 1986 TCP(4P)
All times are GMT -4. The time now is 11:11 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy