For testing it I added these four lines to my /etc/hosts.deny file:

# /etc/hosts.deny

I waited some time and then I tried to gain ssh access to the loop-back IP address. But I still get this:

$ ssh root@localhost
Password: ▊

And I can access it. I even tried it with adding entries explicitly denying access from

closed as off topic by Jacob, TheCleaner, Khaled, kce, mdpc Mar 22 '13 at 0:42

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here. If this question can be reworded to fit the rules in the help center, please edit the question.


Tcpwrappers (which uses the entries in hosts.deny) has been removed from OS X 10.8 (Mountain Lion), so sshd is no longer paying attention to what is in that file. You can use Packet Filter instead, or install libwrap via MacPorts and recompile sshd.

Run "man pfctl" to get details on how to control and configure the rules.

There's a nice run-down on how to use pfctl here: A Cheat Sheet For Using pf in OS X Lion and Up

Not the answer you're looking for? Browse other questions tagged or ask your own question.