Hello Fedora devels and users,
more than three years ago, the same topic started discussion if we want this package in Fedora or not and how [1]. The discussion resulted mostly in flames and in the removal of the dependency on tcp_wrappers from systemd. But it was quite agreed that it is considered as a security layer for some users, if they use it correctly, or something that is or should be replaced by firewalls.
So can we discuss it now once more without the affiliation to systemd? The fact is that we still do not have any other replacement except firewalls. But do we need one?
The complete removal of the package is probably not a wise step, even though we can not find tcp_wrappers in recent SuSE anymore [2]. It is still available in Arch [3] without other tools depending on it. To be fair, Debian [4] is still building tools (for example openssh) with a build-time support for it.
My primary concern is OpenSSH, which upstream dropped support for tcp_wrappers three years ago (late 2014) [5] and since then we are maintaining one more downstream patch. But this effort should be coordinated among other components to simplify the transition for users who insist on using it (using tcpd).
Removing the dependency will also allow us to trim the default install for few more Kb.
If there will be no significant drawbacks, I will progress with filling a system wide change for Fedora 28 and I will pull the maintainers of other tolls using libwrap into the round and discussion.
[1] https://lists.fedoraproject.org/pipermail/devel/2014-March/196913.h tml [2] https://www.rpmfind.net/linux/rpm2html/search.php?query=tcpd&submit =Search+...&system=&arch= [3] https://www.archlinux.org/packages/community/x86_64/tcp-wrappers/ [4] https://packages.debian.org/sid/openssh-server [5] http://www.openssh.com/txt/release-6.7
Thank you for comments and constructive ideas. Regards,
Tom Horsley writes:
On Tue, 15 Aug 2017 13:58:16 +0200 Jakub Jelen wrote:
Thank you for comments and constructive ideas.
I certainly never understood why it existed at all, unless maybe it pre-dated having a firewall. It seems totally redundant to the firewall.
tcp_wrappers was useful. A long time ago. But in the modern age, Internet- facing apps need more sophisticated IP-based access checks. More than a simple accept/reject based on the IP address.
For a mail server, for example, receiving mail from the modern Internet requires a rate-limiting solution; or at the very least a limit on the maximum number of connections from an IP address range. Often I would leave a terminal window scrolling through my mail logs, and I see an attempted dictionary attack at least once an hour.
So, modern Internet-facing apps have to code their own connection filters, tailored for their specific use case. As such, given that they already implement IP address checks, they typically already support the meager functionality that tcp_wrappers implements itself, and they have no need for it.
On Tue, 2017-08-15 at 08:22 -0400, Tom Horsley wrote:
On Tue, 15 Aug 2017 13:58:16 +0200 Jakub Jelen wrote:
Thank you for comments and constructive ideas.
I certainly never understood why it existed at all, unless maybe it pre-dated having a firewall. It seems totally redundant to the firewall.
I can remember as a sysadmin back in the 1990s, I thought it was a lifesaver. Unfortunately, I don't remember *why* I thought it was a lifesaver -- but I remember it being necessary for running things like DenyHosts in the early to mid 2000s.
billo
On Tue, 2017-08-15 at 13:58 +0200, Jakub Jelen wrote:
Hello Fedora devels and users,
more than three years ago, the same topic started discussion if we want this package in Fedora or not and how [1]. The discussion resulted mostly in flames and in the removal of the dependency on tcp_wrappers from systemd. But it was quite agreed that it is considered as a security layer for some users, if they use it correctly, or something that is or should be replaced by firewalls.
So can we discuss it now once more without the affiliation to systemd? The fact is that we still do not have any other replacement except firewalls. But do we need one?
The complete removal of the package is probably not a wise step, even though we can not find tcp_wrappers in recent SuSE anymore [2]. It is still available in Arch [3] without other tools depending on it. To be fair, Debian [4] is still building tools (for example openssh) with a build-time support for it.
My primary concern is OpenSSH, which upstream dropped support for tcp_wrappers three years ago (late 2014) [5] and since then we are maintaining one more downstream patch. But this effort should be coordinated among other components to simplify the transition for users who insist on using it (using tcpd).
Removing the dependency will also allow us to trim the default install for few more Kb.
If there will be no significant drawbacks, I will progress with filling a system wide change for Fedora 28 and I will pull the maintainers of other tolls using libwrap into the round and discussion.
Hello, In Fedora 26, there is over 50 packages using tcp_wrappers as a build- time dependency:
$ dnf repoquery --whatrequires 'libwrap.so.0()(64bit)'|grep x86_64 389-ds-base-snmp-0:1.3.6.6-2.fc26.x86_64 rmeggins aeskulap-0:0.2.2-0.27.beta1.fc26.x86_64 jenslody apcupsd-0:3.14.14-5.fc26.x86_64 tibbs apcupsd-cgi-0:3.14.14-5.fc26.x86_64 apcupsd-gui-0:3.14.14-5.fc26.x86_64 apt-cacher-ng-0:0.9.0-3.fc26.x86_64 kenjiro audit-0:2.7.7-1.fc26.x86_64 sgrubb bacula-client-0:7.4.7-1.fc26.x86_64 slaanesh bacula-director-0:7.4.7-1.fc26.x86_64 bacula-libs-0:7.4.7-1.fc26.x86_64 bacula-storage-0:7.4.7-1.fc26.x86_64 bacula2-client-0:2.4.4-24.fc26.x86_64 limb conserver-0:8.2.1-3.fc24.x86_64 jkastner ctk-devel-0:0.1-0.2.20151015gitbdc8cac.fc26.x86_64 bizdelnick ctk-dicom-0:0.1-0.2.20151015gitbdc8cac.fc26.x86_64 cyrus-imapd-0:3.0.1-7.fc26.x86_64 landgraf dcmtk-0:3.6.1-4.fc24.x86_64 ignatenkobrain dovecot-1:2.2.31-3.fc26.x86_64 mhlavink exim-0:4.89-1.fc26.x86_64 dwmw2 flow-tools-0:0.68.5.1-18.fc26.x86_64 stingray foghorn-0:0.1.6-12.fc26.x86_64 rohara gsi-openssh-server-0:7.5p1-1.fc26.x86_64 ellert libvirt-snmp-0:0.0.3-7.fc24.x86_64 mprivozn libyaz-0:5.14.11-6.fc26.x86_64 guidograzioli lldpd-0:0.9.7-5.fc26.x86_64 jhogarth net-snmp-1:5.7.3-15.fc26.x86_64 jsafrane net-snmp-agent-libs-1:5.7.3-15.fc26.x86_64 nfs-utils-1:2.1.1-5.rc4.fc26.x86_64 steved ngircd-0:24-2.fc26.x86_64 ixs nrpe-0:3.0.1-4.fc26.x86_64 smooge nut-0:2.7.4-7.fc26.x86_64 mhlavink ocserv-0:0.11.8-1.fc26.x86_64 nmav openhpi-subagent-0:2.3.4-28.fc26.x86_64 sharkcz openldap-servers-0:2.4.44-10.fc26.x86_64 mhonek opensips-snmpstats-0:2.2.3-1.fc26.x86_64 ivaxer openssh-server-0:7.5p1-2.fc26.x86_64 jjelen pptpd-0:1.4.0-11.fc26.x86_64 jskarvad prelude-manager-0:3.1.0-2.fc26.x86_64 totol proftpd-0:1.3.6-1.fc26.x86_64 itamarjp ptpd-0:2.3.1-4.fc24.x86_64 pbrobinson pulseaudio-libs-0:10.0-4.fc26.x86_64 lennart quagga-0:1.1.1-2.fc26.x86_64 mruprich quota-rpc-1:4.03-8.fc26.x86_64 ppisar redir-0:2.2.1-16.fc26.x86_64 itamarjp rpcbind-0:0.2.4-7.rc2.fc26.x86_64 steved rwhoisd-0:1.5.9.6-6.fc26.x86_64 ppisar sendmail-0:8.15.2-14.fc26.x86_64 jskarvad slapi-nis-0:0.56.1-2.fc26.x86_64 abbra sslh-0:1.18-2.fc26.x86_64 jhogarth stunnel-0:5.41-1.fc26.x86_64 tmraz syslog-ng-0:3.9.1-1.fc26.x86_64 marcusk tcp_wrappers-devel-0:7.6-85.fc26.x86_64 jjelen tftp-server-0:5.2-20.fc26.x86_64 jsynacek up-imapproxy-0:1.2.8-0.7.20130726svn14389.fc24.x86_64 cmadams uwsgi-router-access-0:2.0.15-1.fc26.x86_64 kad vsftpd-0:3.0.3-5.fc26.x86_64 msehnout xinetd-2:2.3.15-18.fc26.x86_64 jsynacek
I added the main contacts on these packages to the bcc to let them express their opinions on this proposal and usefulness of tcp_wrappers in case of their package and their upstream community.
This is not a call for immediate action, but more a discussion, if there is a way and will to get rid of this dependency.
As already mentioned, I would like to see that go in one go (eg. Fedora 28) so anyone using them currently, can step back to tcpd or swat to firewall at once for all the services, if possible.
Thanks, Jakub
[1] https://lists.fedoraproject.org/pipermail/devel/2014-March/196913 .h tml [2] https://www.rpmfind.net/linux/rpm2html/search.php?query=tcpd&subm it =Search+...&system=&arch= [3] https://www.archlinux.org/packages/community/x86_64/tcp-wrappers/ [4] https://packages.debian.org/sid/openssh-server [5] http://www.openssh.com/txt/release-6.7
Thank you for comments and constructive ideas. Regards, -- Jakub Jelen
-
Jakub Jelen -
Sam Varshavchik -
Tom Horsley -
William Oliver