Hi,
After migrating from Centos To AlmaLinux 8, I need to install tcp_wrappers.
My previous model of security was very based in tcp_wrappers. I request this feature to end the migration.
How can I install tcp_wrappers?
tcp_wrappers are obsolete now. You should use a proper firewall configuration …
What’s the reason behind that bad idea?. I have also a firewall, although tcp_wrappers is an strong layer of security. In 20 years I have seen people bypassing firewalls but no the tcp_wrappers.
Is there no alternative way to add it?
It makes this Linux distro more insecure than others. I suggest to the developers adding again this feature.
It could be possible in a next future?
tcp_wrappers doesn’t even work anymore for most daemons - ssh removed the functionality in 2014, nginx and systemd never supported it. its an el7 era feature, time to move on.
https://fedoraproject.org/wiki/Changes/Deprecate_TCP_wrappers
If you look at the Debian changelog, all of the recent commits are to remove the functionality or disable it for various daemons, and the last upstream commit was 10 years ago:
Fedora offers the migration to systemd eBPF-based filter.
Is this possible in Alma Linux?. Is there some documentation or guide?
Also, it seems the reality is not exactly in that way. At least in this page the Tcp_wrappers still is present in most Linux distros including the new Debian 13 and the future Fedora
https://pkgs.org/search/?q=tcp_wrappers
there are older packets inside the Linux distros with a residual use, and are not removed. Tcp_wrappers still is used by lots of people. There is a lot of software still able to work with tcp_wrappers like dovecot, exim, nfs-utils, proftpd, rpcbind, sendmail, stunnel…
Also there is possibility to patch other software like OpenSSH.
Why you don’t do the same thing than rest of distros. Allowing the use in case of compatible software, and allowing the possibility to apply existing patches for others like OpenSSH.
Why this possibility is absent in AlmaLinux while it is present in most Linux distros?
In my case the security schema in my servers uses tcp_wrappers in a dinamyc way taking profit of its instant execution by rewriting their files. It has been very solid across the years.
If there is no possibility of use or alternative, I will be forced to start to look for another distro.
I believe you should reconsider this issue and do the same thing of what happens in another distros. There is a lot people still using tcp_wrappers for their internet servers.
Many more of what the developers imagine, at least according that bad choosing of a suppression.
I’d call it “pre-el7 era” feature, for tcp_wrappers were deprecated during the lifetime of el7: Chapter 9. Deprecated Functionality | Red Hat Product Documentation
Replacing TCP Wrappers in RHEL 8 - Red Hat Customer Portal looks like one.
AlmaLinux is compatible with Red Hat Enterprise Linux (RHEL). Red Hat has a distinct philosophy for what is in RHEL. There Enterprise Linux are not like “most distros”.
Basically, if you want something added to EL, start by talking to Red Hat.
It looks like Fedora developers started to consider deprecation already in 2014. What Lennart wrote back then has quite a different view on usage than yours: Maybe it's time to get rid of tcpwrappers/tcpd? - devel - Fedora mailing-lists I wonder whose statistics are more representative.
I’m somewhat curious about the circumstances.
yeah, i meant it was “up to and including, but not newer than” i guess 
i just tried my debian 13 box and openssh, sendmail, stunnel and exim no longer support it. rpcbind does, i have no use for an ftp server in 2024.
dovecot i think removed libwrap support, then put it back, it may be gone again now.
anyway, nobody is going to put the package back into any el9 distro, and it has very limited use. there are plenty of firewalls to chose from or the individual packages have ACL support in their own config.
it’s closed. Is there an open document in internet?.
interesting read. In short, a guy says “this packet is older” despite it works well, and without giving another alternative. And the final conclusion is a will to suppress a second layer of protection downgrading the security of the servers.
I don’t know really the open source world and I ignore the affiliations of the people (governments, companies…) Although I remember a similar tyrannical procedure with Mozilla browser quite years ago to delete very strong ciphers like Camellia. Very similar.
Just one guy, a few supporters of the non-sense, and that’s all
Years ago I have suffered a restart of the iptables firewall rules, causing these were fully disabled. The backdoor was an activation facility in the firewall allowing users to unblock their ips by means a captcha form. Not sure if this was my fault because some wrong permissions or maybe not. Anyway, that attack had no serious impact because the tcp_wrappers still were impeding the access to the critical services.
maybe you can read the documentation before to implement this:
arguments like “I don’t use ftp, tcp_wrappers therefore nobody use it” are understable self-realities although are never realistic.
I have many users who demands FTP. And if you ask to any hosting company about suppressing the FTP service, nobody will agree just because this is not “modern” or something like that.
People demands the FTP in the real world, be sure. And also Sysadmins demands tcp_wrappers, be sure. I’m one example among many people using tcp_wrappers.
You can do a search for tcp_wrappers questions only in the last year, and you will discover a big reality ignored in this distro
In that real world, just a few hours ago I was forcing the new modern AlmaLinux 8 to apply a legacy crypto and a server reboot because there a quite customers using Windows7, and they experience problems with their Outlooks.
Call by phone to those customers to requesting the update of their PC’s and these customers will fly in less 48 hours. Talk yourself with Mr. Trilobite wishing to scream to somebody because his politicians are bribers and etcetera. It is better avoid relations except to pay and to facilitate him a Mosaic if necessary.
In the Open Source frequently we see how developers of their new products, desktops environments and, etcetera, they try to force users to adopt their own ideas ignoring the real world and necessities of thousand people. And also we know that most times these projects will enter in decadence soon or later. Keeping happy everybody is not so difficult. Some distros still offer Cobol and Gopher. What you says about the tcp_wrappers is a non-sense.
Anyway, the issue is when I have migrated to AlmaLinux and I find this ugly surprise. If there is no future support I will start a new migration to Ubuntu or RockyLinux.
Note with AlmaLinux I cannot block the Panel daemons with tcp_wrappers as before. And only this detail is enough to me to leave this distro because its poor security facilities. This is something objective: before I was able to have that layer of security, now with AlmaLinux this is not possible and there is no a similar alternative.
I already had an iptables firewall. I use this to isolate the accesses only to specific ports/services and by countries. Besides ipset block lists for tor, vpn, etc,etc. also I have scripts to rewrite the tcp_wrappers files hosts.deny/allow to create a second layer of security according IPs and the parsing of logs from apache, ftp, panel services and etcetera. Extracting IPs. CDIR, and so on.
I cannot replicate all that schema only with one iptables firewall. First, because I would need to rewrite my present firewall code which is a big product not created by me. And even if able to do that, I will loose the present second layer of security offered by tcp_wrappers.
I don’t have any intention to leave my security schema of these years which works quite well to reduce risks. Because it means more tranquility and free time for me.
I prefer to keep an effective linux fossil working very well that expend many days to rebuild all that and anyway loosing a second layer of security. It would be absurd. It isn’t?
It would be absurd for no improvement, and also because the unreal images of the world in the minds of a few people who project this in a Linux distro.
If there is no support for tcp_wrappers I will leave this distro to migrate to Ubuntu, Rocky Linux or whatever.
I confess I’m surprised to read comments about the non-necessity of ftp and etcetera in a distro which seems to be addressed to internet servers. Amazing.
I understand this is the product of its developers and they can do whatever they wish. Just I say like a user, that tf there is no possibility of tcp_wrappers I will change to Ubuntu or Rockly Linux.
its no good moving to Rocky as they are RHEL-based too, I’m not sure what you could migrate to that keeps the functionality - debian/ubuntu are removing it, and you’d need to avoid systemd.
i’d say stay with alma and update your solution as it won’t work anywhere for much longer, but i understand the pain.
I do agree that someone not needing service like FTP is irrelevant and not the view of distro like AlmaLinux.
The question here should be whether the toolset available in Enterprise Linux distro is at least as good as tcp_wrappers used to be, or not?
Considering that Red Hat is concerned about security and does have paying customers, they cannot afford to settle for less. Therefore, whatever RHEL (and Alma and Rocky) has should be good.
If you want a distro that still has tcp_wrappers, then install such distro. (I have no idea which those are.) You don’t have to use a distro that you don’t like due to its features (or lack of).
I’m already looking about it, and probably Ubuntu 22.04 which has end support in 2034-36. From what I read in internet it includes tcp_wrappers working with different versions of openssh, ftp and other essentials. It seems to be the more stable option for the long term. Although now for the gods that I will check essential things before doing a new migration.
In fact this is my fault, forgetting to check the features before doing the migration. By believing it was included when the migration to AlmaLinux was offered by the Panel company.
Of course the developers of this distro can have their own ideas for those users who believe that just one iptables firewall is enough.
I don’t want to say this distro is bad in anyway. No time wasted to have any idea. Just I wrote my case, about this absence and its importance like a second layer of security, at least in my humble experience. I have tested this tool can be really useful in some events. At least to me this is a must when it seems there is no a new similar tool. If this contains old code really I don’t care while it works.
Anyway, thanks to all for the feedback.