hosts.allow hosts.deny format

[XaeroOne]

Hi,

I have a question about the format in hosts.allow and hosts.deny it is very confusing when you see different things mentioned on different sites.

The question is I have seen many sites ask to enter

ALL:ALL

in hosts.deny some place I have seen

ALL:ALL:ALL

to be entered. I can't seem to find any explanation on when to use which entry in hosts.deny

Can someone shed some light?

[matonb]

Hi, XaeroOne

You want to read the Access Control Rules section of the man page ( man hosts.allow or man hosts.deny ). But in a nutshell:

ALL: ALL
deny access to ALL daemons from ALL hosts.

ALL: ALL: ALL
deny access to ALL daemons from ALL hosts and ALL shell commands/variants. ( Overkill in my opinion )

[XaeroOne]

lets say you don't need any incoming connections from anywhere. then entering ALL:ALL in hosts.deny should suffice (from a security point of view) right? Do you need iptables?

[matonb]

from a hosts.deny / allow point of view then yes ALL: ALL should be enough.

As for a firewall ( iptables ), that depends on how your system is connected to the internet. Personally I would use one in anycase.

As your not doing anything special with the host, if it's redhat / centos then you could use the system-config-security tool which will create a simple firewall for you.

If there isn't a similar tool for your distro then a very easy/basic firewall package is firestarter.

HTH

[Spider7]

lets say you don't need any incoming connections from anywhere. then entering ALL:ALL in hosts.deny should suffice (from a security point of view) right? Do you need iptables?

Keep in mind that hosts.allow has precedence, make sure you don't allow connections by accident.

[XaeroOne]

I've heard about firestarter and guard dog, are these frontends for iptables? And how come everyone is talking about iptables whenever there is a discussion about firewalls? Aren't there are other firewall for linux?

[matonb]

Yes firestarter and guard dog are front ends for iptables.
Firewall Builder is another, with a similar interface to checkpoint's Firewall One comercial product.

I don't know of any different firewalling methods other than iptables ( and the old ipchains ) doesn't mean that there isn't something out there though.

[XaeroOne]

Thanks for the help

[Ben Cotton]

lets say you don't need any incoming connections from anywhere. then entering ALL:ALL in hosts.deny should suffice (from a security point of view) right? Do you need iptables?

In my opinion, you definitely still need a firewall. Not all services support tcpwrappers, which means you can't use hosts.(allow|deny) to control access. If you're only running services that use tcpwrappers (e.g. ssh), and you're behind a router or firewall, then you don't necessarily need to run iptables. I still would, as an extra layer of safety.

[XaeroOne]

ok, thank you all for your contributions