TCP Wrapper: Network Monitoring, Access Control, and Booby Traps

This paper presents a simple tool to monitor and control incoming network traffic. The tool has been successfully used for shielding off systems and for detection of cracker activity. It has no impact on legal computer users, and does not require any change to existing systems software or configuration files. The tool has been installed worldwide on numerous UNIX systems without any source code change. The story begins about two years ago. Our university was under heavy attack by a Dutch computer cracker who again and again managed to acquire root privilege. That alone would have been nothing more than an annoyance, but this individual was very skilled at typing the following command sequence: rm-rf / For those with no UNIX experience: this command, when executed at a sufficiently high privilege level (like root), is about as destructive as the MS-DOS format command. Usually, the damage could be repaired from backup tapes, but every now and then people still lost a large amount of work. Though we did have very strong indications about the cracker´s identity I cannot disclose his name. We did give him a nickname, though: "our pet" 1. The destructive behavior of the cracker made it very hard to find out what was going on: the rm-rf removed all traces very effectively. One late night I noticed that the cracker was watching us over the network. He did this by frequently making contact with our finger network service, which gives information about users. Services such as finger do not require a password, and almost never keep a record of their use. That explains why all his fingering activity had remained unnoticed. The natural reaction would be to shut down the finger network service. I decided, however, that it would be more productive to maintain the service and to find out where the finger requests were coming from. In order to explain the problem and its solution I will briefly summarize a typical UNIX implementation of the TCP/IP network services. Experts will forgive me when I make a few simplifications. 1. Like hond (dog), kat (cat), and muis (mouse).