LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)
-   -   Basic hosts.deny Q (https://www.linuxquestions.org/questions/linux-security-4/basic-hosts-deny-q-907012/)

Linux_Kidd 10-07-2011 06:37 PM
Basic hosts.deny Q
 
rhel 5.7 fully updated,
i havent tried this yet, searched LQ but nothing specific.

can i EXCEPT the wildcard keyword ALL

ALL: ALL EXCEPT RFC1918, RFC1918, RFC1918

this would make my life easy since i am trying out denyhosts service. my hosts.allow would be empty. i would like to do it this way to outright deny anything that is not internal IP, then allow denyhosts to write (stack) deny entries for any brute forcing of ssh that might happen from internal IP. and yes, i know about iptables.

allend 10-07-2011 08:27 PM
The purpose of hosts.allow is to add exceptions to what is specified in hosts.deny. http://its.virginia.edu/unixsys/sec/hosts.html
For techniques for handling brute force attacks on ssh, read the sticky post in this forum. http://www.linuxquestions.org/questi...tempts-340366/

Linux_Kidd 10-07-2011 09:02 PM
Quote:
Originally Posted by allend (Post 4492787)
The purpose of hosts.allow is to add exceptions to what is specified in hosts.deny. http://its.virginia.edu/unixsys/sec/hosts.html
For techniques for handling brute force attacks on ssh, read the sticky post in this forum. http://www.linuxquestions.org/questi...tempts-340366/
if i place rfc's in hosts.allow then denyhosts adding entries to hosts.deny would be completely useless. using a combo of sshd config, pam config, and the use of denyhosts gets me the layers and functionality i want w/o extra stuff.

anyone know the answer to my question about the syntax?

allend 10-07-2011 10:27 PM
Perhaps this will help. http://linux.about.com/od/commands/l...l5_hostsde.htm

Linux_Kidd 10-07-2011 10:43 PM
Quote:
Originally Posted by allend (Post 4492836)
nope, doesnt help. i know what all the texts say. it doesnt explain if EXCEPT will apply to the match all "ALL" wildcard keyword. all the man pages give examples of `list_1 EXCEPT list_2', is "ALL" wildcard considered a list?

allend 10-07-2011 11:07 PM
Did you get down to the EXAMPLES section?
Quote:
MOSTLY OPEN
Here, access is granted by default; only explicitly specified hosts are refused service.

The default policy (access granted) makes the allow file redundant so that it can be omitted. The explicitly non-authorized hosts are listed in the deny file. For example:

/etc/hosts.deny: ALL: some.host.name, .some.domain
ALL EXCEPT in.fingerd: other.host.name, .other.domain

The first rule denies some hosts and domains all services; the second rule still permits finger requests from other hosts and domains.

Linux_Kidd 10-08-2011 07:25 AM
Quote:
Originally Posted by allend (Post 4492857)
Did you get down to the EXAMPLES section?
thnx. yes, that example does shows an "ALL EXCEPT" but its on the service side. i will assume the parsing rules carry over to the client_list section (no reason to think it doesnt). i cannot find and example matching mine so i'll just give it a try next week. thnx.

update:
ALL: ALL EXCEPT works as expected.

with a combo of tcpd, pam, and denyhosts i have a flexible configuration that contains access/auth controls at different levels.


All times are GMT -5. The time now is 09:51 AM.