Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have this content in hosts.deny (with a new line at the end):

# hosts.deny    This file describes the names of the hosts which are
#       *not* allowed to use the local INET services, as decided
#       by the '/usr/sbin/tcpd' server.
# The portmap line is redundant, but it is left to remind you that
# the new secure portmap uses hosts.deny and hosts.allow.  In particular
# you should know that NFS uses portmap!

sshd : ALL

And this in hosts.allow:

# hosts.allow   This file describes the names of the hosts which are
#       allowed to use the local INET services, as decided
#       by the '/usr/sbin/tcpd' server.

sshd: our.ip.add.ress: allow

Then, we executed this piece of code to restart SSH:

/etc/init.d/sshd restart

And again, here is a new line at the end. But, we can still reach the SSH service from another server and attempt to login. What are we doing wrong?

share|improve this question
Are you really using hosts.accept or is that a typo? – James O'Gorman Dec 31 '11 at 11:50
Typo, thnx, I meant allow indeed ;). – Kevin Dec 31 '11 at 11:51
Are you able to login?You should get a message ssh_exchange_identification: Connection closed by remote host – Sergei Dec 31 '11 at 12:02
I can suggest the output of James O'Gorman. It will work – Mughil Dec 31 '11 at 18:33

Your /etc/hosts.deny, I think you have a syntax error. There shouldn't be be a space between "sshd" and the colon. So, it should read:

sshd: ALL

On the "allow" side, I have lines like:


There's no trailing text after the IP address.

share|improve this answer
I thought this at first, but the hosts_access(5) man page gives an example of daemon_list : client_list [ : shell_command ]. – James O'Gorman Dec 31 '11 at 12:04
Hmm. Yes, I see that. Interestingly, when they give actual examples, they don't have the space between the daemon and the colon. – cjc Dec 31 '11 at 12:07

You don't need the : allow in hosts.allow. It should just look like this:


If you have console access you can try blocking everything that uses tcpwrappers in case it's an issue with the service name:




share|improve this answer

Is it worth checking to see that support for tcp-wrappers was actually compiled into the sshd you're using?

It needs to have been compiled with either of the --with-libwrap or --with-tcp-wrappers options, according the o'reilly snail book.

(I'm not certain if most distros enable this by default, or what the default compile time option is for open ssh).

I checked mine just now by doing:

ldd /usr/sbin/sshd | egrep 'wrap'

which indicated => /lib64/ (0x00002ba50fa9c000)

(h/t to this Stack Exchange question)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.