15

As the title states, I have a linux box. As far as I can tell I can use hosts.allow / hosts.deny or iptables to secure. What's the difference? Is there another mechanism that can be used?

22

IPTables works at the Kernel level. In general this means it has no knowledge of applications or processes. It can only filter based on what it gets from the various packet headers for the most part.

The host.allow/deny however operates on the application/process level. You can create rules for various processes or daemons running on the system.

So for example IPTables can filter on port 22. SSH can be configured to use this port and generally is, but it can also be configured to be on a different port. IPTables does not know which port it is on, it only knows about the port in the TCP header. The hosts.allow files however can be configured for certain daemons such as the openssh daemon.

If you have to chose I would generally opt for at a minimum IPTables. I view the hosts.allow as a nice bonus. Even thought it seems like the daemon levels seems easier IPTables will block the packet before it really even gets very far. With security the sooner you can block something the better. However, I am sure there are situations however that change this choice.

0

iptables blocks the access before it reaches the application, whereas hosts.allow/hosts.deny is part of PAM and requires the application to implement PAM checking and correctly handle the file. Both are useful, and having both in place is even better.

  • I don't believe the hosts.[allow|deny] files have anything to do with PAM. Were you thinking about tcpwrappers? – EEAA Aug 5 '10 at 16:23
  • Sorry, I was getting it confused with the allow_hosts impementations inside PAM for vsftpd etc. – James L Aug 5 '10 at 16:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.