DEBOPS.TCPWRAPPERS(5)

NAME
debops.tcpwrappers - Manage host access controlled by libwrap

SYNOPSIS

debops service/tcpwrappers [--limit group,host,...] [--diff] [--check] [--tags tag1,tag2,...] [--skip-tags tag1,tag2,...] [<ansible-playbook options>] ...

debops --tags role::tcpwrappers [playbook] ... [--limit group,host,...] [--diff] [--check] [--skip-tags tag1,tag2,...] [<ansible-playbook options>] ...

debops --skip-tags skip::tcpwrappers [playbook] ... [--limit group,host,...] [--diff] [--check] [--tags-tags tag1,tag2,...] [<ansible-playbook options>] ...

DESCRIPTION

The debops.tcpwrappers Ansible role can be used to manage entries in /etc/hosts.allow and /etc/hosts.deny which are used by TCP Wrappers to limit connections to daemons that utilize the libwrap library.

GETTING STARTED

  Initial configuration

The default configuration implemented by debops.tcpwrappers is focused around whitelisting specific IP addresses, CIDR subnets or other entries. Role will automatically block all incoming connections using /etc/hosts.deny and allow you to specify whitelisted exceptions in /etc/hosts.allow.

To support idempotent configuration of different services, role uses the Ansible assemble module to generate the /etc/hosts.allow file from fragments located in /etc/hosts.allow.d/ directory. Any changes in the /etc/hosts.allow file directly will be lost.

Due to SSH service being crucial for Ansible operation, the role takes care not to block the Ansible Controller host from accessing it using data gathered automatically by debops.core role, or by a separate list of Ansible Controller hosts.

  Example inventory

The debops.tcpwrappers role is included by default in the common.yml DebOps playbook. You don't need to configure anything in the inventory to enable it.

  Example playbook

debops.tcpwrappers is designed to be used from a playbook or a role as role dependency. Here's an example configuration:

---
- name: Manage TCP Wrappers
  collections: [ 'debops.debops', 'debops.roles01',
                 'debops.roles02', 'debops.roles03' ]
  hosts: [ 'debops_all_hosts', 'debops_service_tcpwrappers' ]
  become: True
  environment: '{{ inventory__environment | d({})
                   | combine(inventory__group_environment | d({}))
                   | combine(inventory__host_environment  | d({})) }}'
  roles:
    - role: tcpwrappers
      tags: [ 'role::tcpwrappers', 'skip::tcpwrappers' ]

DEFAULT VARIABLE DETAILS

some of debops.tcpwrappers default variables have more extensive configuration than simple strings or lists, here you can find documentation and examples for them.

  tcpwrappers__allow

This is a list of /etc/hosts.allow entries defined as YAML dictionaries. Each entry will be stored in /etc/hosts.allow.d/ directory in a separate file. The configuration roughly follows the conventions described in the hosts_access(5) and hosts_options(5) man pages. The list of known parameters:

daemon
    Required. Name or list of names of the daemons which should be configured, the first entry will be used in th filename if a custom one is not specified.

client
    Optional. String or list of IP addresses, CIDR subnets, domain names and other "clients" that should be allowed (by default) to connect to a given service. If not specified, the access will be granted for all hosts, unless it's disabled by item.accept_any parameter.

    IPv6 addresses should be specified "as is", they will be automatically converted to square bracket notation.

option
    Optional. String or list of additional options for a particular entry. This will be added after list of clients. The colons (:) inside the options are automatically escaped by a backslash. See hosts_options(5) man page for possible values.

custom
    Optional. A YAML text block with raw configuration in /etc/hosts.allow format.

weight
    Optional. Two-digit number prefix added to the entry filename, to allow easier sorting of files in /etc/hosts.allow.d/ directory.

filename
    Optional. Custom name of the file stored in /etc/hosts.allow.d/. If not specified, a name will be generated based on the value of item.daemon or item.daemons parameter.

comment
    Optional. A comment added to the given entry to explain its purpose.

accept_any
    Optional, boolean. If not specified or True, without a specific client list the service that is being configured will acceppt connections from all hosts (ALL). If specified and False, connections won't be allowed unless a list of clients is specified and not empty.

state
    Optional. Either present or absent. If specified and absent, the configuration file will be removed from /etc/hosts.allow.d/ directory, otherwise it will be created.

  Examples

Allow connection from anywhere to sshd:

tcpwrappers__allow:
  - daemon: 'sshd'

Restrict access to vsftpd daemon to a set of particular subnets (IPv6 addresses are wrapped in square brackets automatically):

tcpwrappers__allow:
  - daemon: [ 'vsftpd' ]
    client: [ '192.0.2.0/24', '2001:db8::/32' ]
    accept_any: False

AUTHOR
Maciej Delmanowski

COPYRIGHT
2014-2022, Maciej Delmanowski, Nick Janetakis, Robin Schneider and others