Editing TCP Wrappers (section)

{{Short description|Access control list software}}
__NOTOC__
{{Infobox software
| name = TCP Wrapper
| logo = 
| caption = 
| screenshot = 
| developer = [[Wietse Venema]]
| latest_release_version = 7.6 (April 08, 1997)
| operating_system = [[Unix-like]]
| genre = Security
| license = [[BSD licenses|BSD license]]
| website = [http://ftp.porcupine.org/pub/security/index.html porcupine.org]
}}
'''TCP Wrappers''' (also known as '''tcp_wrappers''') is a host-based networking [[Access control list|ACL]] system, used to [[Filter (software)|filter]] network access to [[Internet protocol suite|Internet Protocol]] servers on ([[Unix-like]]) [[operating system]]s such as [[Linux]] or [[Berkeley Software Distribution|BSD]]. It allows host or [[subnetwork]] [[IP address]]es, [[Hostname|names]] and/or [[ident protocol|ident]] query replies, to be used as tokens on which to filter for [[access control]] purposes.

The original code was written by [[Wietse Venema]] in 1990 to monitor a cracker's activities on the [[Unix]] workstations at the Department of Math and Computer Science at the [[Eindhoven University of Technology]].<ref>[http://ftp.porcupine.org/pub/security/tcp_wrapper.pdf ''TCP WRAPPER - Network monitoring, access control, and booby traps.'' by Wietse Venema (USENIX UNIX Security Symposium III, 1992)]</ref> He maintained it until 1995, and on June 1, 2001, released it under its own [[BSD License|BSD-style license]].

The [[tar (file format)|tar]]ball includes a [[Library (computer science)|library]] named '''libwrap''' that implements the actual functionality. Initially, only services that were spawned for each connection from a [[super-server]] (such as [[inetd]]) got ''wrapped'', utilizing the '''tcpd''' program. However most common network service [[Daemon (computer software)|daemons]] today can be [[Linker (computing)|linked]] against libwrap directly.  This is used by daemons that operate without being spawned from a super-server, or when a single process handles multiple connections.  Otherwise, only the first connection attempt would get checked against its ACLs.

When compared to host access control directives often found in daemons' configuration files, TCP Wrappers have the benefit of [[Run time (program lifecycle phase)|runtime]] ACL reconfiguration (i.e., services don't have to be reloaded or restarted) and a generic approach to network administration.

This makes it easy to use for anti-[[Worm (computing)|worm]] scripts, such as [[DenyHosts]] or [[Fail2ban]], to add and expire client-blocking rules, when excessive connections and/or many failed login attempts are encountered.

While originally written to protect [[Transmission Control Protocol|TCP]] and [[User Datagram Protocol|UDP]] accepting services, examples of usage to filter on certain [[Internet Control Message Protocol|ICMP]] packets exist too, such as 'pingd' &ndash; the [[userspace]] [[Ping (networking utility)|ping]] request responder.<ref>[http://phrack.org/issues/52/7.html#article GNU/Linux Ping Daemon] by route|daemon9 - Phrack Magazine Volume 8, Issue 52 January 26, 1998, article 07</ref>