tcp_wrapper is suppled on the AIX 5.3 extensions CD.

root@aix530:[/export/lpp/expansion]installp -L -d . | grep -i wrap
netsec.options:netsec.options.tcpwrapper.base:1.1.0.0::I:T:::::N:TCP-wrapper::::0::
netsec.options:netsec.options.tcpwrapper.license:1.1.0.0::I:T:::::N:TCP-wrapper License::::0::
netsec.options:netsec.options.tcpwrapper.man.en_US:1.1.0.0::I:T:::::N:TCP-wrapper Doc (en_US)::::0::
netsec.options:netsec.options.tcpwrapper.msg.en_US:1.1.0.0::I:T:::::N:TCP-wrapper Msg (en_US)::::0::

For TCP services that are handled by /etc/inted.conf, e.g. telnet and FTP,
you can install the freeware TCP_wrapper program downloadable from the BULL site,
and put that in front of the required services, then you have /etc/hosts.allow and .deny to control
access to the services.

/etc/hosts.deny:
ALL: ALL

/etc/hosts.allow:
telnetd: 10.5.0.0
telnetd: 192.168.0.0
telnetd: 10.4.1.1

/etc/inetd.conf:
telnet  stream  tcp    nowait  root    /usr/local/bin/tcpd  telnetd -a 
## telnet  stream  tcp    nowait  root    /usr/sbin/telnetd      telnetd -a   

However, that's no good for SSH.  Depending on which version of it you have,
SSHD is permanently set running from inittab using essentially the "start" section
of /etc/rc.openssh for example, which calls on the daemon configuration file
sshd_config:
                print "Starting OpenSSH daemon on port 22"
                cmd /usr/local/sbin/sshd \               
                        -f /etc/openssh/sshd_config \     
                        -h /etc/openssh/ssh_host_key;     
In the config file I have there are no options relating to the control/blocking of
particular IPs for the service.

For details of what to do with passwords, see the headers in the files /etc/security/user & /etc/security/login.cfg.

For services, as in network services,
the file /etc/inetd.conf controls the "transient" ones - comment out anything you don't want to start,
for other permanently running daemons see the files /etc/rc.tcpip or /etc/rc.nfs, and so on.

There is no supplied way to block (network) packets with AIX.  There was once a firewall product that could
be installed on AIX or Windows, but that fell by the wayside in the face of competition from other types of firewall
often specialised integrated devices.  You still have unrelated things like tunnels and encryption.

This server uses our own "blockip" tool to block specific offending IP addresses - details here:
www.rootvg.net/blockip.html (http://www.rootvg.net/blockip.html)

Depends on your level of AIX.

For AIX 5.2 (and less with some modifications) a good start is this redbook: AIX 5L Version 5.2 Security Supplement (http://www.redbooks.ibm.com/abstracts/sg246066.html). In particular, for your question I reccomend reading the Appendix A.

This book is a supplement for the AIX Security "whitebook" that can be found for each version of AIX via the Information Center links (use the rootvg weblink on the right for your version of AIX).

If you have AIX 5.3 or AIX 6.1, one relatively easy way to harden AIX is to use AIX Security Expert (command line: aixpert).

If you have more (specific) questions - just ask.