0

Say /etc/hosts.allow contains this:

ALL EXCEPT in.telnetd : foo.example.com

Someone is telling me that if foo.example.com attempts to telnet into this system, the connection will be denied because of the EXCEPT, and hosts.deny will not be checked.

But doesn't the system need to check hosts.deny? My understanding is that hosts.allow can't, by itself, cause any connections to be denied; only hosts.deny can do that.

So I'm confused. Am I misunderstanding something?

2 Answers 2

4

I think you are correct in this case.

The example in man 5 host_access for the default deny case requires the /etc/hosts.deny file to have

ALL : ALL

in order for an EXCEPT rule to work in /etc/hosts.allow.

Also from the man page:

   o      Access  will  be  granted when a (daemon,client) pair matches an
          entry in the /etc/hosts.allow file.

   o      Otherwise, access will be denied  when  a  (daemon,client)  pair
          matches an entry in the /etc/hosts.deny file.

   o      Otherwise, access will be granted.

So in your case, the host wouldn't match any entries in /etc/hosts.allow, and then wouldn't match any in /etc/hosts.deny and so would be allowed according to the third rule. This is why you need the ALL : ALL entry in /etc/hosts.deny so that the second rule applies.

3

also keep in mind that /etc/hosts.allow and /etc/hosts.deny only affects daemon that runs through inetd or xinetd, not just any (very common mistake)

2
  • Very much correct. It's usually preferable and far more secure to control service access through firewall rules. Jul 29, 2009 at 15:19
  • OpenSSH sshd seems to use hosts.{allow,deny} too. Jul 29, 2009 at 19:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .