HP Secure Shell and tcp wrappers

[Elena Leontieva]

Hello,

I installed T1471AA A.04.50.004 HP-UX Secure Shell on Itanium server running HP-UX 11.23.

The documentation says that the libwrap.a archive library is linked to HP-UX Secure Shell, but I do not see that:
coci161(root):/opt/ssh/etc > ldd /opt/ssh/sbin/sshd
libpam.so.1 => /usr/lib/hpux64/libpam.so.1
libdl.so.1 => /usr/lib/hpux64/libdl.so.1
libnsl.so.1 => /usr/lib/hpux64/libnsl.so.1
libxnet.so.1 => /usr/lib/hpux64/libxnet.so.1
libsec.so.1 => /usr/lib/hpux64/libsec.so.1
libgssapi_krb5.so => /usr/lib/hpux64/libgssapi_krb5.so
libkrb5.so => /usr/lib/hpux64/libkrb5.so
libpthread.so.1 => /usr/lib/hpux64/libpthread.so.1
libc.so.1 => /usr/lib/hpux64/libc.so.1
libxti.so.1 => /usr/lib/hpux64/libxti.so.1
libxti.so.1 => /usr/lib/hpux64/libxti.so.1
libm.so.1 => /usr/lib/hpux64/libm.so.1
libk5crypto.so => /usr/lib/hpux64/libk5crypto.so
libcom_err.so => /usr/lib/hpux64/libcom_err.so
libk5crypto.so => /usr/lib/hpux64/libk5crypto.so
libcom_err.so => /usr/lib/hpux64/libcom_err.so
libdl.so.1 => /usr/lib/hpux64/libdl.so.1
coci161(root):/opt/ssh/etc >

I try to use the access control files, to restrict ssh connections to this server to a limited number of hosts.

Right now I can give access to all hosts by having sshd:ALL in /etc/hosts.allow. ( my /etc/hosts.deny has only ALL:ALL)

If I put sshd: host1, host2 in /etc/hosts.allow I could not ssh from host1 and host2 to the server in question.

What am I missing here?

Thank you,
Elena.

[Court Campbell]

you should see tcp wrappers when you do

# what /usr/sbin/sshd

[Elena Leontieva]

Yes, I do see them:

coci161(root):/opt/ssh/etc > what /usr/sbin/sshd
/usr/sbin/sshd:
$HP-UX Secure Shell: sshd.c,vA.04.50.004 ,TCP Wrappers: v7.6-ipv6.4, Zlib: v1.2.3 2007/05/16 $
$OpenSSL A.00.09.07l.001 $
coci161(root):/opt/ssh/etc >

So, what is the problem? In my /etc/hosts.allow I have a line:
sshd: cocn01

But this is a message I am getting:

cocn01(root):/etc> ssh coci161
ssh_exchange_identification: Connection closed by remote host
cocn01(root):/etc>

[Dennis Handly]

>libwrap.a archive library is linked to HP-UX Secure Shell, but I do not see that:
$ ldd /opt/ssh/sbin/sshd

ldd only lists shared libs.

[Matti_Kurkela · Accepted solution]

When a connection is made, libwrap.a gets only the IP address information from the OS. If the /etc/hosts.allow file specifies a host name, libwrap.a uses the resolver routines to find the hostname for the IP address.

Find the IP address of your cocn01 host. If it's e.g. 111.222.333.444, then run "nslookup 111.222.333.444" on the coci161 host.

If the command cannot resolve the hostname from the IP address, you probably have a problem with _reverse_ DNS. (Sometimes the normal DNS records are spotlessly maintained, but the reverse DNS records are forgotten. This is a DNS admin mistake that is seen fairly often.)

If the nslookup command can resolve the hostname of cocn01 from the IP address, try writing the hostname to the /etc/hosts.allow file in exactly the same form as returned by the nslookup command. Sometimes the short name is not completely equivalent to the fully-qualified hostname (i.e. with the domain name included).

MK

[Elena Leontieva]

The FQDN did it!!

Thank you very much!