Here is a sample /etc/hosts.allow:

#hosts.allow
ALL : .example.com
telnetd : 192.168.25.0/255.255.255.0 EXCEPT 192.168.25.73
sshd, in.tftpd : 192.168.1.10

Why is it in.tftpd and not just tftpd? Can someone please explain?
Why it is not in.telnetd too instead of just telnetd?

Well its actually the string the program is using in its wrapper check, if the program doesn't specify anything or you are using external wrappers then it defaults to the name of the program. So in this instance I'd guess your are using an external wrapper and your tftpd program is called in.tftpd.

Sorry but I did not get you.

What do you mean by "the string the program is using in its wrapper check"?

How to know it should be that?

And what is an external wrapper? I am using tcp wrappers in CentOS 5.

tcp wrappers provides both a library and a program

if programs use the tcpwrappers library they can set their wrapper string to something arbitrary, by wrapper string I mean the string you use in the host.deny host.allow files (this would be using the wrappers internally to the program).

if you use the program for tcp wrappers (usually tcpd) then the wrapper string is set to the name of the program you are wrapping.

The second example in the tcpd manpage gives an idea of the second usage (which I referred to as "using external wrappers").

finger stream tcp nowait nobody /usr/sbin/tcpd in.fingerd

In this instance you are tell tcpd to wrap the program in.fingerd so in hosts.deny hosts.allow you'll use in.fingerd

or in the third example:

ntalk dgram udp wait root /usr/sbin/tcpd /usr/local/lib/ntalkd

In that instance you'll use ntalkd in your hosts.deny hosts.allow files

Fernandoch,

These basic services were typically started by a master TCP listener/launcher program called "inetd", thus the in. prefix.

Some systems still use inetd, while many of today's Linux distributions typically use xinetd, a more modern replacement for inetd.

The idea is - rather than start all the services at boot time, start them only when a network connection is initiated. And once the network connection was terminated, inetd would terminate the service and go back to a listening state. This saved valuable system memory, but it had the downside of creating a delay before the service was ready to service a request.

Thank you to both of you for the clarification.