Arch Linux

T0MAS

Member

Registered: 2007-02-22

Posts: 12

tcp wrappers spawn/twist for hosts.{allow|deny} question

Hi,
I'm trying to setup my hosts.allow, hosts,deny with tcp wrappers spawn.
Here's my hosts.deny;

ALL: ALL  \
: spawn /bin/echo `/bin/date` access denied>>/var/log/hosts.deny.log \
: deny

when I ssh to box, access is denied;
/var/log/auth.log Aug 29 19:46:22 arch sshd[3258]: refused connect from 10.106.155.19
on the client side this looks like this;
ssh_exchange_identification: Connection closed by remote host

/var/log/hosts.deny.log is created, but it's empty, I was expecting an entry in /var/log/hosts.deny.log like this;
Fri Aug 29 13:30:47 BST 2008 access denied
Also is there any way of changing ssh_exchange_identification: Connection closed by remote host for the client i.e. unauthorized connection this has been logged?

Can somebody tell me if I'm doing something wrong?
Thanks everyone for the help!

Last edited by T0MAS (2008-08-29 14:33:48)

Ramses de Norre

Member

From: Leuven - Belgium

Registered: 2007-03-27

Posts: 1,289

Re: tcp wrappers spawn/twist for hosts.{allow|deny} question

man 5 hosts_options

Look at "twist" and "severity".

T0MAS

Member

Registered: 2007-02-22

Posts: 12

Re: tcp wrappers spawn/twist for hosts.{allow|deny} question

Look at "twist" and "severity".

Thanks for your suggestion, I have changed my hosts.deny according to manual

SSHD \
: ALL  \
: spawn /bin/echo logging access deny >>/var/log/hosts.deny.log \
: twist /bin/echo access deny message to the client \
: DENY

Still getting same message on the client and an empty /var/log/hosts.deny.log

Thanks for your help!:D

Ramses de Norre

Member

From: Leuven - Belgium

Registered: 2007-03-27

Posts: 1,289

Re: tcp wrappers spawn/twist for hosts.{allow|deny} question

From the manual:

twist shell_command
          <...> This option must appear at the end of a rule. <...>

Last edited by Ramses de Norre (2008-08-29 15:01:59)

T0MAS

Member

Registered: 2007-02-22

Posts: 12

Re: tcp wrappers spawn/twist for hosts.{allow|deny} question

From the manual:

twist shell_command
          <...> This option must appear at the end of a rule. <...>

Thanks for pointing out above and sorry about that ... I have changed my hosts.deny file so it looks like this;

SSHD \
: ALL  \
: spawn /bin/echo logging access deny >>/var/log/hosts.deny.log \
: DENY \
: twist /bin/echo access deny message to the client

I'm still having the same, no message is sent to client (twist) and nothing is logged (spawn)

Last edited by T0MAS (2008-08-29 15:16:36)

Ramses de Norre

Member

From: Leuven - Belgium

Registered: 2007-03-27

Posts: 1,289

Re: tcp wrappers spawn/twist for hosts.{allow|deny} question

I'm sorry, I'm out of ideas... Maybe someone else can help you further..

gckida

Member

Registered: 2021-05-07

Posts: 1

Re: tcp wrappers spawn/twist for hosts.{allow|deny} question

I'm late, but for anyone with the same 'problem' you just need to run the ssh command with the verbose option ssh -v localhost then you should see the following:

ssh -v localhost
...
debug1: kex_exchange_identification: banner line 0: deny message to the client
kex_exchange_identification: read: Connection reset by peer

Thats supposing that inside of /etc/hosts.deny file is:

sshd : LOCAL \
       : spawn /bin/echo `/bin/date` access denied >> /var/log/ssh.log \
       : twist /bin/echo deny message to the client

---

The most precious possession you have in the world is your own people.

ewaller

Administrator

From: Pasadena, CA

Registered: 2009-07-13

Posts: 20,583

Re: tcp wrappers spawn/twist for hosts.{allow|deny} question

Thanks.   Using this opportunity to close this 13 yr old thread.

---

Nothing is too wonderful to be true, if it be consistent with the laws of nature -- Michael Faraday
The shortest way to ruin a country is to give power to demagogues.— Dionysius of Halicarnassus
---
How to Ask Questions the Smart Way