Installation doc FAQ clarification.

cactus · 2005-01-08 06:51:44

http://www.archlinux.org/docs/en/guide/ … guide.html

I can't ssh into my machine!
Edit your /etc/hosts.deny file. The default configuration will reject all incoming connections.

Shouldn't people just add

sshd:ALL

to /etc/hosts.allow ?
Allow rules supercede deny rules, so ssh would be allowed. Then all the other connections are still by default denied.
I think that would be better.

Comments?

scottro · 2005-01-08 15:19:52

I agree There should be a few examples, that one, or, for example, allowing it from your network, such as

ALL: EXCEPT 192.168.1.0/255.255.255.0

I find that that Arch is one of the few distributions still using that instead of iptables, so I constantly forget the syntax.

oscar · 2005-01-08 20:35:32

I think this sounds like a good idea - but a stupid one, at the same time.
Surely, they have sshd access after a default install - but what if they are hosting a webpage on the computer, and haven't even noticed the hosts.deny-file, and can't make the httpd work properly?

A short message after installing ssh that you should check out /etc/hosts.deny before getting any help would suffice, IMHO

cactus · 2005-01-08 20:47:09

httpd doesn't listen to hosts.allow or deny. Only programs that use tcp_wrappers care about what is in those files.

my hosts.deny

ALL: ALL: DENY

my hosts.allow

sshd:ALL

I run web, mail, ssh, and more on that box. I, of course, use a firewall to control what I let in, and out. I don't know exactly which programs actually use tcp_wrappers, but off the top of my head I am pretty sure that nfs and sshd use it.

oscar · 2005-01-08 22:10:17

cactus wrote:

httpd doesn't listen to hosts.allow or deny. Only programs that use tcp_wrappers care about what is in those files.
my hosts.deny
ALL: ALL: DENY
my hosts.allow
sshd:ALL
I run web, mail, ssh, and more on that box. I, of course, use a firewall to control what I let in, and out. I don't know exactly which programs actually use tcp_wrappers, but off the top of my head I am pretty sure that nfs and sshd use it.

Ah - in that case, if sounds like a great idea!
nfs isn't installed nor enabled per default, so it shouldn't pose a threat either

cactus · 2005-01-09 03:33:11

oh, and portmap usually.

Arch Linux

#1 2005-01-08 06:51:44

Installation doc FAQ clarification.

#2 2005-01-08 15:19:52

Re: Installation doc FAQ clarification.

#3 2005-01-08 20:35:32

Re: Installation doc FAQ clarification.

#4 2005-01-08 20:47:09

Re: Installation doc FAQ clarification.

#5 2005-01-08 22:10:17

Re: Installation doc FAQ clarification.

#6 2005-01-09 03:33:11

Re: Installation doc FAQ clarification.

Board footer