Arch Linux

Mr. Alex

Member

Registered: 2010-08-26

Posts: 623

ALL: ALL: DENY in hosts.deny

https://wiki.archlinux.org/index.php/SSH :

Now you should check your /etc/hosts.deny for the following line and make sure it looks like this:

ALL: ALL: DENY

Why add "DENY" option to hosts.deny file?

tomk

Forum Fellow

From: Ireland

Registered: 2004-07-21

Posts: 9,839

Re: ALL: ALL: DENY in hosts.deny

Because that's what it's for.

Default configuration for tcp_wrappers is to deny all access. hosts.allow is then used to allow specific access only.

Read man 5 hosts_access for full details.

Mr. Alex

Member

Registered: 2010-08-26

Posts: 623

Re: ALL: ALL: DENY in hosts.deny

But wiki suggests to add this to hosts.deny file which already sets things to deny. To think about it - you don't need to type "DENY" options for things that are already in deny file.

Leonid.I

Member

From: Aethyr

Registered: 2009-03-22

Posts: 999

Re: ALL: ALL: DENY in hosts.deny

But wiki suggests to add this to hosts.deny file which already sets things to deny. To think about it - you don't need to type "DENY" options for things that are already in deny file.

You don't need DENY (or allow in /etc/hosts.allow). However, including it does not generate an error because tcp_wrappers in arch are compiled with -DPROCESS_OPTIONS. Here is a piece of hosts_access man page:

An  extended version of the access control language is described in the hosts_options(5) document. The extensions  are  turned  on  at  program build time by building with -DPROCESS_OPTIONS.

and the PKGBUILD

make REAL_DAEMON_DIR=/usr/sbin STYLE=-DPROCESS_OPTIONS linux

As far as I understand, the extended syntax enables you to have only one file, where all, i.e. allowed and denied, hosts are indicated.

---

Arch Linux is more than just GNU/Linux -- it's an adventure
pkill -9 systemd

Mr. Alex

Member

Registered: 2010-08-26

Posts: 623

Re: ALL: ALL: DENY in hosts.deny

But is it OK if I save only "ALL : ALL" there?

Last edited by Mr. Alex (2010-12-27 15:37:09)

Leonid.I

Member

From: Aethyr

Registered: 2009-03-22

Posts: 999

Re: ALL: ALL: DENY in hosts.deny

Yes, you'll be fine. Actually, both ALL:ALL and ALL:ALL DENY will have the same effect...

---

Arch Linux is more than just GNU/Linux -- it's an adventure
pkill -9 systemd