hosts.allow or iptables?

zenlord · 2009-02-17 12:01:38

Hi,

Setting up a server for the first time and I'm granting only access from the local network by setting all daemons separately as 192.168.0.0/255.255.255.0 in /etc/hosts.allow.

Now I was wondering if this is as safe as installing and running iptables. I know I have a lot more options with iptables (outgoing traffic etc.), but is this a safe way of setting up a server? I am only installing and running the bare minimum of packages to ensure I don't have anything open that I don't need.

I would like to keep it simple at first, but over time I might be interested in making this server (privately) accessible over the internet...

Zl.

ckristi · 2009-02-17 13:17:02

Well... your best bet would be to use both hosts.allow AND iptables-based firewall. Iptables would be your first line of defense, while hosts.allow the second (and only for tcpwrapper-aware daemons, e.g.: telnet, ssh; a counter example would be the Apache HTTP server which has its own connection prevention mechanisms, not based on hosts.allow/deny).
Arch has two packages in extra who should help you in setting an iptables firewall: fwbuilder and firestarter. I personally prefer an older script, based on ncurses (console-based). It's called EasyTables... but it's unmaintained now and probably harder to find it on the net.. though I think I've seen the project still being present on SourceForge not so long ago.

fukawi2 · 2009-02-17 22:40:22

I'd suggest iptables. I try to avoid using the tcp-wrappers and do everything in iptables. It keeps all config for who's allowed and who isn't in one central place instead of spread out disparately which makes it easier to maintain.

Of course, I roll my own iptables rules too, so maybe I'm just a nerd

ckristi · 2009-02-18 19:14:47

@fukawi2: It's good to be a nerd, but the man seems a beginner. With an iptables helper he'll get a working script (modifiable after he gets familiar with iptables) by answering a few easy questions. He'll also be able to skip loads of iptables man pages and at the same time he's getting an working firewall quickly. And, after all... the resulting script may be a good point of starting to learn iptables, rather than just reading the manual.

Last edited by ckristi (2009-02-18 19:15:55)

zenlord · 2009-02-18 20:42:41

@ckristi: thx for the compliment (and for the help of course... )

THX - I will get into iptables once every service on my server is working the way I want it to. That way iptables cannot get in the way of debugging my setup.

Zl.

ckristi · 2009-02-19 20:07:21

@zenlord:
Sorry if I made you feel offended. That was definitely not my purpose.

Arch Linux

#1 2009-02-17 12:01:38

hosts.allow or iptables?

#2 2009-02-17 13:17:02

Re: hosts.allow or iptables?

#3 2009-02-17 22:40:22

Re: hosts.allow or iptables?

#4 2009-02-18 19:14:47

Re: hosts.allow or iptables?

#5 2009-02-18 20:42:41

Re: hosts.allow or iptables?

#6 2009-02-19 20:07:21

Re: hosts.allow or iptables?

Board footer