Use TCP Wrappers to Restrict Access to the eyeInspect SSH Service

TCP Wrappers Overview

TCP Wrappers is an open source host-based Access Control List (ACL) system. It’s useful to restrict access to TCP network services based on the host name, IP address, network address of the requester. In TCP Wrappers, the restricted and allowed services can be defined easily in a plain text file. TCP Wrappers is installed by default on the eyeInspect server.

TCP Wrappers implements access control by means of two configuration files:

/etc/hosts.allow
/etc/hosts.deny

When an SSH network request reaches the eyeInspect Command Center or Passive Sensor server, the hosts.allow will be evaluated first and will therefore determine if the source host is allowed to access the SSH service.

Note: eyeInspect only supports restrictions to the sshd service. Access to other existing network services (e.g. PostgreSQL) cannot be restricted because these applications are not compiled with the libwrap library.

This section explains how to modify the hosts.allow file to restrict access to the eyeInspect SSH service.

The following constraints and restrictions apply to the hosts.allow file:

The hosts.allow file can be used for defining both allow and deny rules
Only one rule per service is allowed
The order of the rules matters. Only the first matching rule for a given service will be taken into account
If there are no matching rules for a service, then access to the service will be allowed to all remote hosts
Any changes in either hosts.allow or hosts.deny files will come to effect immediately without restarting the network services

TCP Wrappers Configuration Example

This example describes how users can restrict access to the eyeInspect SSH service.

The figure below illustrates a simplified ICS/SCADA network, where an eyeInspect Primary Command Center and eyeInspect Secondary Command Center and a Passive Sensor are deployed.

To restrict access to the SSH service, the hosts.allow file has to be modified on each eyeInspect server. Assuming the management IP addresses of the eyeInspect servers depicted above, the content of the hosts.allow files shall be the following:

Content of the hosts.allow file on the eyeInspect Primary Command Center
```
sshd: 192.168.57.5 192.168.57.6
sshd: ALL: DENY
```
Content of the hosts.allow file on the eyeInspect Secondary Command Center
```
sshd: 192.168.57.3 192.168.57.5
sshd: ALL: DENY
```
Content of the hosts.allow file on the Passive Sensor
```
sshd: 192.168.57.3 192.168.57.5 192.168.57.6
sshd: ALL: DENY
```

TCP Wrappers is a valuable addition to enhance the security of eyeInspect servers. More restrictive security configurations can also be set using iptables.