TCP wrappers provide a means to control which IP addresses are allowed or not allowed to connect to services that you have enabled on your host such as Remote Login (ssh), Apple Remote Desktop (vnc), and Personal Web Sharing (www).<\/p>\n
As with other Operating Systsems, MAC OS X uses the tcp daemon (tcpd) to implement this functionality\u00a0 (see “man tcpd”<\/em>).<\/p>\n In order to make use of tcp wrappers, you need to create two files in \/etc<\/strong> called hosts.deny<\/strong> and hosts.allow<\/strong> (see samples below). Both files must be present in order for this to work. If you do not create these files, the entire Internet has access to the services you have enabled greatly lowering the security of your host.<\/p>\n In Terminal, after you become super user (likely by sudo -s), you may use your favorite text editor such as pico or vi to create the two files.<\/p>\n Sample \/etc\/hosts.deny<\/strong><\/p>\n # Sample \/etc\/hosts.allow<\/strong><\/p>\n # The “ALL: ALL:deny” statement in the \/etc\/hosts.deny files prevents all external hosts from accessing the host you created the files on.<\/p>\n Then we allow only those hosts we trust or need, to accomplish the task at hand. In the example above, only hosts on the 128.197.79 subnet are allowed to access the host. NOTE: There is a . after the 79; you need that in order for this to work. You can allow connections from all of the Boston University subnets by removing the entire .79 line and adding the following:<\/p>\n ALL: 128.197. Keep in mind that this is a very broad range covering most of the Boston University campuses.\u00a0 To refine this further, see our documentation on the Campus IP Address Space<\/a>.<\/p>\n You can also limit access to only a few other hosts by adding an entry for only those IPs in the \/etc\/hosts.allow file as seen in the example below.<\/p>\n ALL: 128.197.2.25How to Configure TCP Wrappers<\/h2>\n
\n# hosts.deny This file describes the names of the hosts which are
\n# denied the use of local INET services, as decided
\n# by the ‘\/usr\/sbin\/tcpd’ server.
\n#
\nALL: ALL:deny<\/p>\n
\n# hosts.allow This file describes the names of the hosts which are
\n# allowed to use the local INET services, as decided
\n# by the ‘\/usr\/sbin\/tcpd’ server.
\n#
\nALL:128.197.79.<\/p>\nExplanation of Sample Files<\/h3>\n
\nALL: 168.122.
\nALL: 155.144.<\/p>\n
\nALL: 128.197.5.89<\/p>\n