A good guild for installing SSH with TCP Wrappers

[Travis Harp]

I have the SSH depot as well as the TCP Wrapper depot from the HP site.

I'm new to using either of these and wonder if anyone has a good guide that would show me how to TCP Wrap SSH correctly.

Thanks

[Steven E. Protter]

Secure Shell Configuration
http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/T1471-90005/T1471-90005_top.html&con=/hpux/onlinedocs/T1471-90005/00/00/11-con.html&toc=/hpux/onlinedocs/T1471-90005/00/00/11-toc.html&searchterms=Shell%7cConfiguration%7cSecure&queryid=20030714-124242

TCP Wrapper
http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/5969-4315/5969-4315_top.html&con=/hpux/onlinedocs/5969-4315/00/00/4-con.html&toc=/hpux/onlinedocs/5969-4315/00/00/4-toc.html&searchterms=Wrapper%7cConfiguration%7cTCP&queryid=20030714-124330


Impact: TCP Wraper(itrc thread).
http://search.hp.com/redirect.html?url=http%3A//forums.itrc.hp.com/cm/QuestionAnswer/1,,0xd01936e69499d611abdb0090277a778c,00.html&qt=TCP+%2BWrapper+%2BConfiguration&hit=1

Also attaching a doc on exhanging public keys.

SEP

[Sridhar Bhaskarla]

Hi Travis,

There are two cases to configure ssh with tcp_wrappers.

1. If it is already compiled with tcp_wrappers. Then it will respond to /etc/hosts.allow and /etc/hosts.deny files. Put the following line in
/etc/hosts.deny

ALL: ALL

If the SSH was precompiled with tcp_wrappers, then it should deny all connections to ssh with a message in syslog.log

If so, then edit /etc/hosts.allow and add the entries like

sshd: .yourdomain.com otherhost.otherdomain.com

etc.,

it will allow connections only from any host from your domain and only other host from other domain.

If ssh does not respond to hosts.deny file, then you will need to configure in inetd.conf to make the 'tcpd' as the proxy to your sshd in the following way.

2. Configure your ssh in the following way

ssh stream tcp nowait root /opt/tcp_wrappers/sbin/tcpd /opt/openssh2/sbin/sshd

Try the above test again with hosts.deny and hosts.allow

However, running sshd through inetd will slow your ssh connections and it is not preferred.

Look at tcp_wrappers man page to find the format of hosts.allow and hosts.deny files.

-Sri

[Travis Harp]

Thanks for the info guys. I'm going to get to digesting all of it.

Travis