Which of the following files does a TCP Wrapper check before starting a network daemon?

3.12.2 Configuring and Using TCP Wrappers

TCP wrappers provide basic filtering of incoming network traffic. You can allow or deny access from other systems to certain wrapped network services running on a Linux server. A wrapped network service is one that has been compiled against the libwrap.a library. You can use the ldd command to determine if a network service has been wrapped as shown in the following example for the sshd daemon:

# ldd /usr/sbin/sshd | grep libwrap
	libwrap.so.0 => /lib64/libwrap.so.0 (0x00007f877de07000)

When a remote client attempts to connect to a network service on the system, the wrapper consults the rules in the configuration files /etc/hosts.allow and /etc/hosts.deny files to determine if access is permitted.

The wrapper for a service first reads /etc/hosts.allow from top to bottom. If the daemon and client combination matches an entry in the file, access is allowed. If the wrapper does not find a match in /etc/hosts.allow, it reads /etc/hosts.deny from top to bottom. If the daemon and client combination matches and entry in the file, access is denied. If no rules for the daemon and client combination are found in either file, or if neither file exists, access to the service is allowed.

The wrapper first applies the rules specified in /etc/hosts.allow, so these rules take precedence over the rules specified in /etc/hosts.deny. If a rule defined in /etc/hosts.allow permits access to a service, any rule in /etc/hosts.deny that forbids access to the same service is ignored.

The rules take the following form:

daemon_list : client_list [: command] [: deny]

where daemon_list and client_list are comma-separated lists of daemons and clients, and the optional command is run when a client tries to access a daemon. You can use the keyword ALL to represent all daemons or all clients. Subnets can be represented by using the * wildcard, for example 192.168.2.*. Domains can be represented by prefixing the domain name with a period (.), for example .mydomain.com. The optional deny keyword causes a connection to be denied even for rules specified in the /etc/hosts.allow file.

The following are some sample rules.

Match all clients for scp, sftp, and ssh access (sshd).

sshd : ALL

Match all clients on the 192.168.2 subnet for FTP access (vsftpd).

vsftpd : 192.168.2.*

Match all clients in the mydomain.com domain for access to all wrapped services.

ALL : .mydomain.com

Match all clients for FTP access, and displays the contents of the banner file /etc/banners/vsftpd (the banner file must have the same name as the daemon).

vsftpd : ALL : banners /etc/banners/

Match all clients on the 200.182.68 subnet for all wrapped services, and logs all such events. The %c and %d tokens are expanded to the names of the client and the daemon.

ALL : 200.182.68.* : spawn /bin/echo `date` “Attempt by %c to connect to %d" >> /var/log/tcpwr.log

Match all clients for scp, sftp, and ssh access, and logs the event as an emerg message, which is displayed on the console.

sshd : ALL : severity emerg

Match all clients in the forbid.com domain for scp, sftp, and ssh access, logs the event, and deny access (even if the rule appears in /etc/hosts.allow).

sshd : .forbid.com : spawn /bin/echo `date` "sshd access denied for %c" >>/var/log/sshd.log : deny

For more information, see the hosts_access(5) manual page.

Tch 14Which of the following can you use to configure firewall rules for IPv6 on a Linux system?ip6tablesTch 14TCP WrapperPerfTch 14udevadm control --reloadPerfWhich of the following commands can be used to view the quota for a user?Tch 14visudoWhich of the following commands will change the SELinux security context of a file?chconPerfWhich of the following commands will generate a GPG public/private key pair?gpg --gen-keyTch 14dmidecodeWhich of the following does the -r option for the gpg command specify?Encrypt for the user id given.Which of the following files does a TCP wrapper check before starting a network daemon?/etc/hosts.allow and /etc/hosts.denyTch 14TACACS+Tch 14Which of the following is not a valid Apparmor command?Tch 14--use-agentTch 14Which of the following options for the gpg command will specify the key that should be retrieved?--recv-keysSecurity, Troubleshoot &PerfSecurity, Troubleshoot &PerfWhich of the following can you use to start network daemons in order to limit which computers areallowed to connect to the network service?Security, Troubleshoot &PerfWhich of the following commands allows a standard user to execute a single command as rootwithout actually switching to the root account?Which of the following commands can be used for the command line version of a popular GUI-basedprogram that is used to examine network traffic passing to and from a network interface?Which of the following commands can be used to determine the round trip time that a packet takesto traverse a network connection?Which of the following commands can be used to force udev to reload new rules from the/etc/udev/rules directory? (Choose all that apply.)Security, Troubleshoot &PerfWhich of the following commands can be used to force udev to reload new rules from the/etc/udev/rules directory? (Choose all that apply.)Which of the following commands can you use to list users who have been locked out bypam_faillock.so?Which of the following commands will allow an administrator to edit the list of permissions assignedto a user wanting to run the sudo command?Which of the following commands will allow the root user to switch to another user account withouthaving to enter that user account’s password?Security, Troubleshoot &PerfWhich of the following commands will list the BIOS information about a device when it cannototherwise be detected by a Linux system?Which of the following files contains the encrypted passwords for users on a modern Linux system bydefault?

Which of the following files contains the encrypted passwords for users on a modern Linux?

Which of the following files contains the encrypted password of the users?

Where are the files stored that contain information for all of the time zones that could be recognized by a Linux operating system?

Which of the following commands will display the exit status of the last command used in the bash shell?