Question about hosts.allow/hosts.deny

Mr. Alex · 2011-07-18 17:11:16

Hello!

I have

ALL: ALL

in /etc/hosts.deny
and some services in /etc/hosts.allow excluding httpd. However, I can get access to my sites which are hosted by Apache (localy). I don't have httpd in my /etc/hosts.allow at all. So why does Apache give me access to my sites? Thinking it through, it should be denied by /etc/hosts.deny...

oliver · 2011-07-18 17:23:27

Not sure if you have a config error somewhere, but /etc/hosts.allow and /etc/hosts.deny is being deprecated

http://www.archlinux.org/news/dropping- … s-support/

2011-07-16 - Dan McGee

tcp_wrappers support is being dropped from all packages and the package removed from [core]. This is due to upstream not having released a new version since April 1997. Additionally, newer daemons and applications are inconsistent in their support for libwrap, leading to confusion as to whether an application supports the library.

If you currently use /etc/hosts.allow or /etc/hosts.deny for security or logging purposes, you will need to adjust accordingly and use another tool such as iptables, or other firewall helper programs.

Additionally, the denyhosts package will be dropped as it depends on tcp_wrappers to enforce the banned hosts list. A useful alternative is fail2ban.

Mr. Alex · 2011-07-18 17:37:16

Thanks, this explains the situation.
Will these files (hosts.{allow,deny}) be deleted from Arch in near future? Just curious.

Army · 2011-07-18 17:51:48

Well, they belong to the package tcp_wrappers, which still is in the repo, but I guess it will be deleted soon. I already removed it. Now we all have to learn how iptables work. Take a look into the wiki, there are good starting guides.

toofishes · 2011-07-18 18:15:31

httpd has never been built with tcp_wrappers support, so your config in the files had no effect whatsoever for Apache. Another reason why we're dumping tcp_wrappers- it is hard to know whether a piece of software is even built with support for it.

Mektub · 2011-07-18 18:27:22

Army wrote:

Well, they belong to the package tcp_wrappers, which still is in the repo, but I guess it will be deleted soon. I already removed it. Now we all have to learn how iptables work. Take a look into the wiki, there are good starting guides.

Army,

pacman -R tcp_wrappers
checking dependencies...
error: failed to prepare transaction (could not satisfy dependencies)
:: esound: requires tcp_wrappers
:: inetutils: requires tcp_wrappers
:: libmysqlclient: requires tcp_wrappers
:: nfs-utils: requires tcp_wrappers
:: openssh: requires tcp_wrappers
:: rrdtool: requires tcp_wrappers
:: syslog-ng: requires tcp_wrappers
:: xinetd: requires tcp_wrappers

did you force the removal of tcp_wrappers ?

Mektub

bluepumpkin · 2011-07-18 20:53:04

Mektub,
Perhaps your system is out of date? Nothing on my system depends on tcp_wrappers, and I have esound, inetutils, openssh, and syslog-ng installed.

student975 · 2011-07-18 21:18:18

I also have with up to date Arch:

$ sudo pacman -R tcp_wrappers
checking dependencies...
error: failed to prepare transaction (could not satisfy dependencies)
:: esound: requires tcp_wrappers
:: inetutils: requires tcp_wrappers
:: libmysqlclient: requires tcp_wrappers
:: openssh: requires tcp_wrappers
:: syslog-ng: requires tcp_wrappers

karol · 2011-07-18 21:19:22

bluepumpkin wrote:

Mektub,
Perhaps your system is out of date? Nothing on my system depends on tcp_wrappers, and I have esound, inetutils, openssh, and syslog-ng installed.

http://www.archlinux.org/packages/core/ … _wrappers/

Mektub · 2011-07-18 21:24:53

bluepumpkin wrote:

Mektub,
Perhaps your system is out of date? Nothing on my system depends on tcp_wrappers, and I have esound, inetutils, openssh, and syslog-ng installed.

Just checked, and all my packages are the latest stable (x86-64) version.

esound 0.2.41-1
inetutils 1.8-2
openssh 5.8p2-8
syslog-ng 3.2.4-2

I even checked with the mirror list status on the ARCH homepage and put the freshest one on top of the mirrorlist file.

But I also noticed that all these files have an upgraded version on testing.
Perhaps you have "testing" enabled.

Anyhow, no hurry, I can wait.

Mektub

bluepumpkin · 2011-07-18 21:47:58

D'oh, I am running [testing]. Ignore me.

Arch Linux

#1 2011-07-18 17:11:16

Question about hosts.allow/hosts.deny

#2 2011-07-18 17:23:27

Re: Question about hosts.allow/hosts.deny

#3 2011-07-18 17:37:16

Re: Question about hosts.allow/hosts.deny

#4 2011-07-18 17:51:48

Re: Question about hosts.allow/hosts.deny

#5 2011-07-18 18:15:31

Re: Question about hosts.allow/hosts.deny

#6 2011-07-18 18:27:22

Re: Question about hosts.allow/hosts.deny

#7 2011-07-18 20:53:04

Re: Question about hosts.allow/hosts.deny

#8 2011-07-18 21:18:18

Re: Question about hosts.allow/hosts.deny

#9 2011-07-18 21:19:22

Re: Question about hosts.allow/hosts.deny

#10 2011-07-18 21:24:53

Re: Question about hosts.allow/hosts.deny

#11 2011-07-18 21:47:58

Re: Question about hosts.allow/hosts.deny

Board footer