tcpd

TCP Wrapper, commonly known as tcpd, is a host-based network access control system that allows administrators to restrict access to network services based on the originating IP address. It acts as a front-end for many common network daemons, such as telnetd, ftpd, and rshd, by intercepting connection requests before they reach the actual service.

The functionality of tcpd is controlled by two configuration files: hosts.allow and hosts.</strong>allow. These files specify which hosts are permitted to access specific services and which are denied. The rules within these files are evaluated sequentially, and the first rule that matches a connection request determines whether the connection is allowed or denied.

For example, a rule in hosts.allow might permit all connections from a specific IP address to the SSH service, while a rule in hosts.deny could block all connections from a particular subnet to any service. This provides a flexible and granular way to manage network security.

TCP Wrapper is written in C and is typically installed as a shared library or as a wrapper executable that runs the actual service. Its simplicity and effectiveness have made it a popular choice for securing network services on Unix-like operating systems for many years, though its functionality is now often integrated into more comprehensive firewall solutions.