Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

As the title states, I have a linux box. As far as I can tell I can use hosts.allow / hosts.deny or iptables to secure. What's the difference? Is there another mechanism that can be used?

share|improve this question

2 Answers 2

up vote 19 down vote accepted

IPTables works at the Kernel level. In general this means it has no knowledge of applications or processes. It can only filter based on what it gets from the various packet headers for the most part.

The host.allow/deny however operates on the application/process level. You can create rules for various processes or daemons running on the system.

So for example IPTables can filter on port 22. SSH can be configured to use this port and generally is, but it can also be configured to be on a different port. IPTables does not know which port it is on, it only knows about the port in the TCP header. The hosts.allow files however can be configured for certain daemons such as the openssh daemon.

If you have to chose I would generally opt for at a minimum IPTables. I view the hosts.allow as a nice bonus. Even thought it seems like the daemon levels seems easier IPTables will block the packet before it really even gets very far. With security the sooner you can block something the better. However, I am sure there are situations however that change this choice.

share|improve this answer

iptables blocks the access before it reaches the application, whereas hosts.allow/hosts.deny is part of PAM and requires the application to implement PAM checking and correctly handle the file. Both are useful, and having both in place is even better.

share|improve this answer
    
I don't believe the hosts.[allow|deny] files have anything to do with PAM. Were you thinking about tcpwrappers? –  EEAA Aug 5 '10 at 16:23
    
Sorry, I was getting it confused with the allow_hosts impementations inside PAM for vsftpd etc. –  James Lawrie Aug 5 '10 at 16:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.