Host files, remote access

Bodyweb · 07-19-2006, 10:22 AM

Pardon me if I start quoting another thread, it's to have not to much OT.

Quote:

Originally Posted by unSpawn

/etc/hosts.deny:

Code:

ALL: ALL

/etc/hosts.allow:

Code:

sshd: 127.0.0.1, 10.1.1.
vncserver: 127.0.0.1, 10.1.1.

I'm not sure about the name of the "vncserver" entry: replace with the name of the running VNC daemon.

That's clear, but suppose I have a web server and email server in this machine, by inserting in the host.deny ALL:ALL it should be stopped also avery connection from the web and on the 25 and 110 port, isn't it ?

I should add those services to host.allow too.

bathory · 07-19-2006, 11:04 AM

The /etc/hosts.allow and /etc/hosts.deny are used to allow/deny access to services controlled by inetd (or xinetd) using tcp-wrappers. Usually webservers and smtp servers are not started through (x)inetd so there is no problem. Also pop server that is controlled from inetd is not using tcp-wrappers, so there is no problem too.
Tcp-wrappers are used for services such as telnet, ftp etc. Take a look here for more details.

Regards

Bodyweb · 07-20-2006, 10:57 AM

Did it and it works very good, thank U

unSpawn · 07-20-2006, 11:26 AM

To clarify:
The /etc/hosts.allow and /etc/hosts.deny are used to allow/deny access to services controlled by inetd (or xinetd) using tcp-wrappers.
/etc/hosts.allow and /etc/hosts.deny are used to allow/deny access to services whose daemon can use tcp_wrappers: this means compiled with -lwrap, for example OpenSSH (ldd /location/of/sshd | grep libwrap). Xinetd doesn't use tcp_wrapper config files but provides a way through it's own service config files.

Bodyweb · 07-20-2006, 11:32 AM

So, you mean that if you kill or crash the xinetd service U can contact the daemons behind it or not ?

unSpawn · 07-20-2006, 12:40 PM

if you kill or crash the xinetd service U can contact the daemons behind it or not ?
Xinetd provides access to services, it starts the related daemons to handle the request.
No Xinetd, no Xinetd services.

Bodyweb · 07-20-2006, 01:06 PM

Quote:

Originally Posted by unSpawn

Xinetd provides access to services, it starts the related daemons to handle the request.
No Xinetd, no Xinetd services.

Just what I'd like to hear