how to hosts.allow and host.deny fc6

[FCL_user]

2 questions:

1) how to block 1 IP
When I add the IP in host.deny it don't seems to work
111.222.333.444.deny example

2) How to block all IP's and add only the IP's in hosts.allow
I tried to add in hosts.deny ALL:ALL but it does not work.

I'm using Fedora Core 6

Regards

FCL_user

[InfRecursion]

Add the line to /etc/hosts.deny

ALL:111.222.333.444

[FCL_user]

Originally Posted by InfRecursion

Add the line to /etc/hosts.deny

ALL:111.222.333.444

I add the IP to /etc/hosts.deny

ALL:111.222.333.444

Then did the following things in therminal:

service iptables save

service iptables restart

And It does no work...!

Why?

Originally Posted by ibbo

To go further

Add
ALL:ALL to hosts.deny
This then stops everything dead by default

In hosts.allow you can then open bits n bats like ssh
sshd: <ip address>, <another ip address>
vsftpd: <ip address>

It should have worked just fine. Try looking at your firewall too to ensure certain ports etc are not blocked.

Ibbo

Why does adding ALL:ALL in hosts.deny does not work?


also did:

Then did the following things in therminal:

service iptables save

service iptables restart

And It does no work again...!

Could it has something to do with the thing that a have a tcp port open in iptables?

My iptables:

# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 19000 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

[markkuk]

iptables and hosts.allow/deny have nothing to do with each other. What do you mean exactly by "it does not work"? What services are you trying to control? How are you testing the function of tcp_wrappers? What messages do you see in system logs?

[FCL_user]

Originally Posted by markkuk

iptables and hosts.allow/deny have nothing to do with each other. What do you mean exactly by "it does not work"? What services are you trying to control? How are you testing the function of tcp_wrappers? What messages do you see in system logs?

Hi Markkuk,

1) I add ALL:ALL to hosts.deny and it does not block ALL IP's ! that's what I mean with its does not work.

2) Is block one IP on a other linux pc, when I add ALL: IP it does not block that IP!


reagrds

[markkuk]

Originally Posted by FCL_user

1) I add ALL:ALL to hosts.deny and it does not block ALL IP's !

What software are you using to test this? What protocol isn't blocked? Are you sure the server software is compiled with libwrap support?
You need to provide more specific information instead of just repeating "it does not work" if you actually want help with your problem.

[ibbo]

To go further

Add
ALL:ALL to hosts.deny
This then stops everything dead by default

In hosts.allow you can then open bits n bats like ssh
sshd: <ip address>, <another ip address>
vsftpd: <ip address>

It should have worked just fine. Try looking at your firewall too to ensure certain ports etc are not blocked.

Ibbo

[glennzo]

Hello MarksCorner. With respect to your needs and the fact that this thread is three years old, go ahead and create a new thread so I can close this one. I'll wait a bit though.

[MarksCorner]

Originally Posted by glennzo

Hello MarksCorner. With respect to your needs and the fact that this thread is three years old, go ahead and create a new thread so I can close this one. I'll wait a bit though.

Thanx and sorry...
I started a new thread on what I am trying to accomplish here.
http://forums.fedoraforum.org/showth...21#post1416621