tcp_wrappers ======================================================================== With this package you can monitor and filter incoming requests for the SYSTAT, FINGER, FTP, TELNET, RLOGIN, RSH, EXEC, TFTP, TALK, and other network services. NOTE: For IPv6 operation, I suspect you may need to add the following to /etc/hosts (that is, %WINDIR%/system32/drivers/etc/hosts). 127.0.0.1 localhost ::1 localhost ::ffff:127.0.0.1 localhost However, unlike on many linux distributions, you do NOT want to add mymachine or mymachine.mydomain to those entries. Doing that will truly mess up hostname matching for the loopback connection. (It probably messes it up on linux, too, but they don't seem to use the 'paranoid' setting in /etc/hosts.allow, like we do). If you insist, you could add the mymachine entries to /etc/hosts, but you definitely need to turn off 'paranoid' checking in /etc/hosts.allow. Build requirements cygwin-1.7.25-1 gcc-core-4.7.3-2 binutils-2.23.51-1 cygport-0.14.0 Canonical homepage: ftp://ftp.porcupine.org/pub/security/index.html Canonical download: ftp://ftp.porcupine.org/pub/security/ License: MIT/X11 (more or less) Language: C ======================================================================== Port Notes: Incorporates the Debian extensions: * cygwrap-0.dll and libwrap.dll.a are available for dynamic linking. * You can blacklist a whole bunch of hosts at once by specifying a file that contains a list of those hosts instead of just naming a host. See the hosts_access(5) manpage. * You can allow or disallow access to a service depending on the exit status of a program. See the hosts_access(5) manpage. * CIDR support in hosts_access(5) functions. * %r and %R parameters in hosts_access(5) functions. * Servers can be matched by port number other than by process name. * IPv6 support: patches are applied and IPv6 is enabled for this cygwin-1.7-specific build. * manpages for installed tools not provided by upstream source Build options: ======================================================================== STYLE = "-DPROCESS_OPTIONS -DACLEXEC" Debian TCP Wrappers use the extended syntax for /etc/hosts.allow and /etc/hosts.deny. This particularly affects spawning other commands on connections, see the hosts_options(5) manpage for more details. FACILITY = LOG_DAEMON SEVERITY = LOG_INFO TCP Wrappers logs as daemon.info (rather than mail.info). This is a change from earlier cygwin releases of tcp_wrappers. BUGS = Cygwin has no bugs. At least, none that the tcp_wrappers upstream developer knows about specifically. VSYSLOG = cygwin has vsyslog built in, since 1.5.6/2004Jan19 (patch applied 2003-09-29) UMASK = -DDAEMON_UMASK=022 NETGROUP = RFC931_TIMEOUT = 10 ACCESS = -DHOSTS_ACCESS TABLES = -DHOSTS_DENY=\"/etc/hosts.deny\" -DHOSTS_ALLOW=\"/etc/hosts.allow\" KILL_OPT = -DKILL_IP_OPTIONS LIBS = EXTRA_CFLAGS = -DSYS_ERRLIST_DEFINED -Dsys_errlist=_sys_errlist -Dsys_nerr=_sys_nerr -DHAVE_STRERROR -DHAVE_STRONGSYMS STRONGSYMS: the cygwin versions of cygwrap-0.dll AND libwrap.a (that is, both the DLL and the static library) explicitly provide int deny_severity int allow_severity symbols. This means that clients must NOT define their own versions of these symbols, as is the practice on *nix systems. Instead, clients should rely on the /declaration/ provided in tcpd.h: extern int deny_severity; extern int allow_severity; This may require code changes in clients that link against libwrap, but it was a necessary API change to enable DLL builds on cygwin. ======================================================================== MULTI-HOMED ISSUES On a multi-homed machine, you sometimes can't rlogin (or rsh, or rexec, etc) to localhost via its short hostname (but 'localhost' and the fully-qualified name both work). This is because 'rlogin mymachine' will actually create a connection to the server across the first interface it finds, which may not necessarily be the one you expect. For instance, my computer's main (wireless) interface is 192.168.1.3, but I have a wired interface as well as a few VMWare virtual interfaces. 192.168.199.1 (VMware) 192.168.154.1 (VMware) 192.168.1.42 (wired) 192.168.1.3 (wireless) Note that "inactive" -- e.g. disconnected -- interfaces would not show up in this list. However, the VMware virtual interfaces are always "connected" unless I specifically disable them from the control panel. Now, if I were to type 'rlogin mymachine', rlogin would create a connection across the 192.168.199.1 interface, because 'mymachine' resolves for each of those interfaces. (OTOH, mymachine.mydomain is interface specific, and would resolve only to 192.168.1.3). Now, rlogind recieves this connection and verifies that yes, 192.168.199.1 does in fact correspond to 'mymachine', and happily checks the IP address against /etc/hosts.allow via libwrap. And that's where the problem occurs. Since 192.168.1.* is my "main" network, I don't have any rules in /etc/hosts.allow for the 192.168.199.* or 192.168.154.* networks -- and libwrap denies access. Note that this really only affects loopback connections; remote connections work fine. So, the solution is to do one of the following: 1) use 'localhost' 2) use FQDN mymachine.mydomain 3) use explicit IP addr (192.168.1.3 or 127.0.0.1) 4) disable all unused interfaces (*) (*) In my case, I hardly ever use my VMware virtual network, so I can easily turn those off, and turn them back on only when needed. Furthermore, the wired and wireless IPs are both in the same subnet, so whichever one of those gets used, things would still work ok. Besides, "unplugged" networks don't show up in the list anyway, so...when the wireless is working, don't plug in the ethernet cable. ======================================================================== ---- tcp_wrappers-7.6-22 -- 2013 Nov 06 ---- * Rely on cygport to autogenerate setup.hints * Added debuginfo package * First cygwin64 release ---- tcp_wrappers-7.6-21 -- 2010 Mar 28 ---- * Updated hosts.allow to add IPv4-in-IPv6 localhost alias [::ffff:127.0.0.1]/128 * Rebuilt using gcc4, against non-beta version of cygwin-1.7.x. * Fixed a few thinkos with respect to the logging level variables. * Restructured cygport to use cygport-0.9.x features * Added note in README concerning /etc/hosts * Added a lot of documentation concerning multi-homed computers. ---- tcp_wrappers-7.6-20 -- 2009 Mar 28 ---- * Modified cygport procedure * Updated hosts.allow (added 'ALL : localhost 127.0.0.1/32 [::1]/128 : ALLOW' line) * Updated to r16 (from r15) debian patchlevel ---- tcp_wrappers-7.6-5 -- 27 Apr 2008 ---- * Requires cygwin-1.7 * Update to latest debian fixes: + New patch catch-sigchld: unblocks and catches SIGCHLD from spawned shell commands and uses waitpid to prevent waiting for the childs of the calling application. (From the Fedora package, fixes RH #112975 and RH #156373.) https://bugzilla.redhat.com/show_bug.cgi?id=112975 https://bugzilla.redhat.com/show_bug.cgi?id=156373 * IPv6 support turned on ---- tcp_wrappers-7.6-4 -- 22 Feb 2008 ---- * Switch to cygport build tool * incorporate debian patches -- see README.Debian * build shared library * split into multiple packages * new maintainer ----- tcp_wrappers-7.6-3 -- 22 Feb 2008 ---- * -- unreleased -- ----- tcp_wrappers-7.6-2 -- 14 Apr 2006 ---- * Simply moved documents to /usr/share per FHS. ----- tcp_wrappers-7.6-1 -- 26 Jun 2002 ---- * if /etc/hosts.deny or /etc/hosts.allow do not exist, then default versions are created. The default version blocks everything except local services and sshd. * Since tcp_wrappers must be built "in" the source directory, we use 'shtool' to make a symlink-farm "copy" of srcdir within .build. ======================================================================== Cygwin port maintained by: Charles Wilson