-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Paul Johnson wrote:
> One security tip I got years ago was to turn off all access by setting
> the file /etc/hosts.deny like this:
>
> ALL:ALL
>
>
> And then in /etc/hosts.allow, I allow in only specific services and
> specific ip address ranges that I want to allow. For example, I
> usually allow only ssh connections from a few specific places:
>
> ALL: 127.0.0.1
> sshd: 24.124.
> sshd: 129.237.
> sshfwd-X11: 24.124.
> sshfwd-X11: 129.237.
>
> This has served me well to keep out other users and protect myself
> from starting services that I don't want.
>
> Now in FC6 I notice that xinetd is not installed and so these host
> files have no effect. of course, I can install xinetd, but I'm
> suspecting that the FC6 designers want me to do something else in
> order to control access. How does one achieve the same effect without
> using xinetd?
What does xinetd not being installed have to do with ssh checking
hosts.{deny,allow}? Dropping ALL:ALL in /etc/hosts.deny and reloading
sshd works as expected here to deny access to ssh. I don't see why
any other service that uses hosts.{deny,allow} wouldn't work the same
way. Not all services use those files though, and security is always
better in layers. If you really want to block access, use a firewall
as well as securing the services you can via hosts.{deny,allow} (or
better yet just not running them in the first place).
- --
Todd OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp
======================================================================
Politicians are interested in people. Not that this is always a
virtue. Fleas are interested in dogs.
-- P.J. O'Rourke
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
iQFDBAEBAgAtBQJFY9opJhhodHRwOi8vd3d3LnBvYm94LmNvbS9+dG16L3BncC90
bXouYXNjAAoJEEMlk4u+rwzjR2EH/225QZmDRm9/q7HlAJUcM7c5QdxsoXa/6IGs
tFD8y6nUBBvhmZV9UVX4+GGCaCIhvOUZvblD8phh9SYBm3C/06XgbQwDM55J20EX
lCCmEOX3c7tKIbpC+Wmg/+XlQzx4TkhpqygdQESaoCT+eu5oSxh74qXwC+BHI+ap
2K98gqBdryAloGxTnTqxbOkjTewGlzPWMrAbBxJCD8YAoGCfqN08GZ6Qb8f/0It2
wvwp3c6i4R4h/K5lT1HVOreeqADXCzj6gdzowmjQwoR2HZKzKcl4L0Ndd7NOlHLZ
pR+3myo7eNb9IwGOQ8L2LZxK/Y9iZZyDX0w2bxThnkNqi2LC4sk=
=k5Z0
-----END PGP SIGNATURE-----
--
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
