TCPWrapper block IP

noir911 · 02-04-2009, 05:40 PM

I'm trying to block a single IP that's showing up in my apache log. I have put it in my /etc/hosts.deny as ALL: IP_Address (haven't restarted any daemon after making the change - not sure if I need to).

But that IP is still showing up in my apache log - how do I block it or know that it's been blocked?

I don't want to deny it via iptables or apache.

Thanks.

anomie · 02-04-2009, 05:54 PM

You can only use tcp wrappers if the binary was compiled to support it. Look at these two examples -- the first binary has tcp wrappers support compiled in; the second does not.

w/ tcp wrappers

Code:

%whereis -b sshd
sshd: /usr/sbin/sshd

%ldd /usr/sbin/sshd | grep 'libwrap'
        libwrap.so.0 => /usr/lib/libwrap.so.0 (0x00954000)

w/o tcp wrappers

Code:

%whereis -b httpd
httpd: /usr/sbin/httpd.worker /usr/sbin/httpd /etc/httpd /usr/lib/httpd

%ldd /usr/sbin/httpd | grep 'libwrap'

If recompiling Apache web server is not an option (I suspect it isn't), then you'll want to look at blocking the IP address with a host-level packet filtering firewall, or within the Apache config file itself.

What OS/version are you asking about? And what version of httpd?

-------

edit: Just saw this -

Quote:

Originally Posted by noir911

I don't want to deny it via iptables or apache.

Why is that?