2.1 Configure TCP Wrappers - inetadm

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version


TCP Wrappers is a host-based access control system that allows administrators to control
who has access to various network services based on the IP address of the remote end of
the connection. TCP Wrappers also provide logging information via syslog about both
successful and unsuccessful connections.


TCP Wrappers provides granular control over what services can be accessed over the
network. Its logs show attempted access to services from non-authorized systems, which
can help identify unauthorized access attempts.


To enable TCP Wrappers, run the following commands:

1. Create and customize your policy in /etc/hosts.allow:

# echo "ALL: <net>/<mask>, <net/<mask>, ..." > /etc/hosts.allow

where each / combination (for example, the Class C address block
"") can represent one network block in use by your
organization that requires access to this system.

2. Create a default deny policy in /etc/hosts.deny:

# echo "ALL: ALL" >/etc/hosts.deny

3. Enable TCP Wrappers for all services started by inetd:

# inetadm -M tcp_wrappers=TRUE

To protect only specific inetdservices, use the command:

# inetadm -m [FMRI] tcp_wrappers=TRUE

where [FMRI] is the service to protect.
To enable TCP Wrappers for the RPC port mapping service, use the commands:

# svccfg -s rpc/bind setprop config/enable_tcpwrappers=true

# svcadm refresh rpc/bind

To protect UDP and RPC-based services that are spawned from inetd, consider
implementing a host-based firewall. Oracle Solaris PF firewall (a.k.a. PF) has replaced
Solaris IP Filter (IPF) in Solaris 11.4. See firewall(5)for more information.

See Also