Enabling TCP Wrappers to block inter-zone traffic
1 Comment Published September 25th, 2006 in Solaris.
TCP Wrappers has been around for many, many years. It is used to restrict access to TCP services based on host name, IP address, network address, and so on. For more details on what TCP Wrappers is and how you can use it, see tcpd(1M). TCP Wrappers was integrated into the Solaris Operating System starting in the Solaris 9 release, where both Solaris Secure Shell and inetd-based (streams, nowait) services were wrapped. Bonus points are awarded to anyone who knows why UDP services are not wrapped by default.
If you have a Solaris 10 box configured with multiple zones, then each zone on the box is by default able to communicate with any other zone on the box, provided that it has a route. There’s two ways of mediating inter-zone traffic on the same box which do work. The first of these involves a little twist on routing, and the second involves tcp_wrappers.
Continue reading ‘Enabling TCP Wrappers to block inter-zone traffic’