Re: why is xinetd not installed by default in FC6?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Paul Johnson wrote:
> One security tip I got years ago was to turn off all access by setting
> the file /etc/hosts.deny like this:
> 
> ALL:ALL
> 
> 
> And then in /etc/hosts.allow, I allow in only specific services and
> specific ip address ranges that I want to allow.  For example, I
> usually allow only ssh connections from a few specific places:
> 
> ALL: 127.0.0.1
> sshd: 24.124.
> sshd: 129.237.
> sshfwd-X11: 24.124.
> sshfwd-X11: 129.237.
> 
> This has served me well to keep out other users and protect myself
> from starting services that I don't want.
> 
> Now in FC6 I notice that xinetd is not installed and so these host
> files have no effect.  of course, I can install xinetd, but I'm
> suspecting that the FC6 designers want me to do something else in
> order to control access. How does one achieve the same effect without
> using xinetd?

What does xinetd not being installed have to do with ssh checking
hosts.{deny,allow}?  Dropping ALL:ALL in /etc/hosts.deny and reloading
sshd works as expected here to deny access to ssh.  I don't see why
any other service that uses hosts.{deny,allow} wouldn't work the same
way.  Not all services use those files though, and security is always
better in layers.  If you really want to block access, use a firewall
as well as securing the services you can via hosts.{deny,allow} (or
better yet just not running them in the first place).

- -- 
Todd        OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp
======================================================================
Politicians are interested in people. Not that this is always a
virtue.  Fleas are interested in dogs.
    -- P.J. O'Rourke

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iQFDBAEBAgAtBQJFY9opJhhodHRwOi8vd3d3LnBvYm94LmNvbS9+dG16L3BncC90
bXouYXNjAAoJEEMlk4u+rwzjR2EH/225QZmDRm9/q7HlAJUcM7c5QdxsoXa/6IGs
tFD8y6nUBBvhmZV9UVX4+GGCaCIhvOUZvblD8phh9SYBm3C/06XgbQwDM55J20EX
lCCmEOX3c7tKIbpC+Wmg/+XlQzx4TkhpqygdQESaoCT+eu5oSxh74qXwC+BHI+ap
2K98gqBdryAloGxTnTqxbOkjTewGlzPWMrAbBxJCD8YAoGCfqN08GZ6Qb8f/0It2
wvwp3c6i4R4h/K5lT1HVOreeqADXCzj6gdzowmjQwoR2HZKzKcl4L0Ndd7NOlHLZ
pR+3myo7eNb9IwGOQ8L2LZxK/Y9iZZyDX0w2bxThnkNqi2LC4sk=
=k5Z0
-----END PGP SIGNATURE-----


[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux