The tcpd is use to access control facility for internet services. The tcpd program can be set up to monitor incoming requests for telnet, finger, ftp, exec, rsh, rlogin, tftp, sshd and other services that have a one-to-one mapping onto executable files. Your sshd server must be configuring (compiled with) to support tcpd. You can find out tcpd (tcpwrapper) support easily with the following command:
# strings $(which sshd)| grep libwrap
libwrap.so.0 libwrap refuse returns
If you see libwrap as output (as shown above) then you can use tcpd as follows to monitor incoming ssh requests.
Open or edit file /etc/hosts.deny using a text editor such as vi. This file lists hosts or IPs that are not allowed to access the system. In this example, you will block sshd server TCP port 22 for selected IPs.
Let us say you would like to deny access to IPs 18.104.22.168 22.214.171.124 126.96.36.199:
# vi /etc/hosts.deny
Add/append the following line:
sshd: 188.8.131.52 184.108.40.206 220.127.116.11
Save and close the file. Next, make sure your rules are correct and run syntax check using the following command:
# tcpdchk -v
Using network configuration file: /etc/inetd.conf >>> Rule /etc/hosts.deny line 20: daemons: sshd clients: 18.104.22.168 22.214.171.124 126.96.36.199 access: denied