Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Say /etc/hosts.allow contains this:

ALL EXCEPT in.telnetd : foo.example.com

Someone is telling me that if foo.example.com attempts to telnet into this system, the connection will be denied because of the EXCEPT, and hosts.deny will not be checked.

But doesn't the system need to check hosts.deny? My understanding is that hosts.allow can't, by itself, cause any connections to be denied; only hosts.deny can do that.

So I'm confused. Am I misunderstanding something?

share|improve this question

2 Answers 2

I think you are correct in this case.

The example in man 5 host_access for the default deny case requires the /etc/hosts.deny file to have

ALL : ALL

in order for an EXCEPT rule to work in /etc/hosts.allow.

Also from the man page:

   o      Access  will  be  granted when a (daemon,client) pair matches an
          entry in the /etc/hosts.allow file.

   o      Otherwise, access will be denied  when  a  (daemon,client)  pair
          matches an entry in the /etc/hosts.deny file.

   o      Otherwise, access will be granted.

So in your case, the host wouldn't match any entries in /etc/hosts.allow, and then wouldn't match any in /etc/hosts.deny and so would be allowed according to the third rule. This is why you need the ALL : ALL entry in /etc/hosts.deny so that the second rule applies.

share|improve this answer

also keep in mind that /etc/hosts.allow and /etc/hosts.deny only affects daemon that runs through inetd or xinetd, not just any (very common mistake)

share|improve this answer
    
Very much correct. It's usually preferable and far more secure to control service access through firewall rules. –  Kamil Kisiel Jul 29 '09 at 15:19
    
OpenSSH sshd seems to use hosts.{allow,deny} too. –  grawity Jul 29 '09 at 19:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.