TCP wrapper problem

[gilsont]

[TT]

On AIX 5.3 I have got TCP wrappers working but not quite as I require.

In /etc/hosts.allow I have

telnetd : labnim

And this allows all users to telnet in from labnim. If I try to restrict this to only root from labmin using:

telnetd : root@labnim

... all telnet connections are denied and root can no longer log in. How can I restrict access to just root?

[/TT]

 

[hirschaj]

Is remote login enabled for root?


Jim Hirschauer

http://www.aixexpert.com

 

[gilsont]

Jim - yes it is.

The wrapper logs say 'connection refused' when I have 'root@labnim' but a connection is allowed with just 'labnim'.

 

[hirschaj]

What does the telnet line in your /etc/inetd.conf file look like? Also, have you tired using the FQDN for labnim as an alternative to just the hostname?


Jim Hirschauer

http://www.aixexpert.com

 

[gilsont]

Jim - thanks for your continued assistance.

We do not have a NIS environment and so there is no FQDN.
The /etc/ined.conf line for telnet reads:

telnet stream tcp nowait root /usr/local/bin/tftpd telnet -a

I altered 'tcp6' to be 'tcp'.

It just does not seems to recognise the root@host syntax in /etc/hosts.allow.

Tim

 

[Mag0007]

hey,

check your hosts.deny file.

 

[hirschaj]

hmmmm, not sure if this will make a difference but I think your inetd.conf entry should read....

telnet stream tcp nowait root /usr/local/bin/tftpd telnetd -a

Also, you don't need to be running NIS to have a FQDN. Do you use DNS? Do you just resolve using host files? Name resolution can cause all sorts of strange issues when using tcp services.


Jim Hirschauer

http://www.aixexpert.com

 

[gilsont]

Hi,

My /etc/hosts.deny file contains:

ALL: ALL

Jim - actually I do have

telnet stream tcp nowait root /usr/local/bin/tftpd telnetd -a

in /etc/inetd.conf ( I made a typo when appending to the forum).

I am just using /etc/hosts - no DNS or NIS.

This is really frustrating - do any others have the ability under AIX to use TCP wrappers to lock down a service to one userid form one host only?

Tim.

 

[Mag0007]

try this:
instead of using hostname, use the ip address

 

[gilsont]

... using the IP address also doesn't fix the problem.

Anyone have any more ideas?

 

[rzs0502]

Try :

telnetd: root@labnim : ALLOW

"If you always do what you've always done, you will always be where you've always been."

 

[rzs0502]

Try :

telnetd: root@labnim : ALLOW

In hosts.allow

"If you always do what you've always done, you will always be where you've always been."