Say /etc/hosts.allow contains this:
ALL EXCEPT in.telnetd : foo.example.com
Someone is telling me that if foo.example.com attempts to telnet into this system, the connection will be denied because of the EXCEPT, and hosts.deny will not be checked.
But doesn't the system need to check hosts.deny? My understanding is that hosts.allow can't, by itself, cause any connections to be denied; only hosts.deny can do that.
So I'm confused. Am I misunderstanding something?