[SOLVED] 14.1: Compilling openSSH with tcp_wrappers enabled.

rshepard · 07-21-2014, 10:08 AM

I want to install, configure, and run DenyHosts on my server and it requires openSSH to be compiled with tcp_wrappers enabled. I have always thought this was the case on Slackware. But, running the test on the DenyHosts Web site (edit /etc/ssh/hosts.deny and add sshd 127.0.0.1, then try to login via ssh localhost. I was asked for my password and allowed in.

My server is also my main workstation. Does this explain the results I observed?

Rich

ml4711 · 07-21-2014, 11:48 AM

14.1 is compiled with tcp_wrappers enabled!

from TCP Wrappers Reference Guide:

Because access rules in hosts.allow are applied first, they take precedence over rules specified in hosts.deny. Therefore, if access to a service is allowed in hosts.allow, a rule denying access to that same service in hosts.deny is ignored.
The rules in each file are read from the top down and the first matching rule for a given service is the only one applied. Therefore the order of the rules is extremely important.
If no rules for the service are found in either file, or if neither file exists, access to the service is granted.

So if You have in hosts.allow

Code:

ALL: ALL

You are allowed in even if you have the service in hosts.deny

Quote:

edit /etc/ssh/hosts.deny and add sshd 127.0.0.1,
then try to login via ssh localhost. I was asked for my password and allowed in.

Syntax - Rember ":" after service name.

For example

Code:

sshd: 127.0.0.1 192.168.1. 192.168.2. 192.168.3. 10.8.0. [2002:50a6:9862:5678::]/64

It works perfectly in slackware 14.1

rshepard · 07-22-2014, 08:23 AM

Thanks for clarifying. I've not looked at the tcp_wrappers docs for a long time. I'll fix hosts.allow to allow hosts.deny to work properly.

Rich