As the title states, I have a linux box. As far as I can tell I can use hosts.allow / hosts.deny or iptables to secure. What's the difference? Is there another mechanism that can be used?

3 Answers 3


IPTables works at the Kernel level. In general this means it has no knowledge of applications or processes. It can only filter based on what it gets from the various packet headers for the most part.

The host.allow/deny however operates on the application/process level. You can create rules for various processes or daemons running on the system.

So for example IPTables can filter on port 22. SSH can be configured to use this port and generally is, but it can also be configured to be on a different port. IPTables does not know which port it is on, it only knows about the port in the TCP header. The hosts.allow files however can be configured for certain daemons such as the openssh daemon.

If you have to chose I would generally opt for at a minimum IPTables. I view the hosts.allow as a nice bonus. Even thought it seems like the daemon levels seems easier IPTables will block the packet before it really even gets very far. With security the sooner you can block something the better. However, I am sure there are situations however that change this choice.


iptables blocks the access before it reaches the application, whereas hosts.allow/hosts.deny is part of PAM and requires the application to implement PAM checking and correctly handle the file. Both are useful, and having both in place is even better.

  • 1
    I don't believe the hosts.[allow|deny] files have anything to do with PAM. Were you thinking about tcpwrappers?
    – EEAA
    Commented Aug 5, 2010 at 16:23
  • Sorry, I was getting it confused with the allow_hosts impementations inside PAM for vsftpd etc.
    – James L
    Commented Aug 5, 2010 at 16:25

TCP Wrappers only restricts access to 'wrapped' services, processes that have been explicitly compiled against the libwrap.a library.

Access to other processes is not impacted.

For example, if you set ALL:ALL in hosts.deny, then you won't be able to create a new incoming connection to sshd, but connections to netcat will work just fine.

Under some circumstances, wrapping can depend on hostnames, rather than IP addresses, but this protection is a bit limited and not as hard to bypass as it should be.

There's no reason I can think of not to use TCP Wrappers, but I don't think it reliably does anything that can't be done better and cleaner with IPTables.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .