<div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small;color:rgb(51,51,255)">From what I remember hosts.allow and hosts.deny only work with services that use TCP Wrappers. </div><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small;color:rgb(51,51,255)">You can use the ldd commmand to determine if libwrap is compiled into a daemon:</div><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small;color:rgb(51,51,255)"><div class="gmail_default">sudo ldd /usr/sbin/sshd| grep wrap</div><div><br></div><div>For me ssh has libwrap complied in so I could use either iptables or /etc/hosts.deny to block access.</div></div></div><div class="gmail_extra"><br clear="all"><div><div dir="ltr"><div>-- JD Austin<br>Voice: 480.269.4335 (480 2MY Geek)<br><a href="mailto:jd@twingeckos.com" target="_blank">jd@twingeckos.com</a></div><br></div></div>
<br><div class="gmail_quote">On Wed, Oct 15, 2014 at 2:05 PM, <span dir="ltr"><<a href="mailto:techlists@phpcoderusa.com" target="_blank">techlists@phpcoderusa.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
<br>
I use IPTable to protect ssh. Should I be using hosts.allow instead? How does host.allow differ from using IPTables to deny all IP's to a specific port except for the IP's you want to give access?<br>
<br>
Keith<div class="HOEnZb"><div class="h5"><br>
<br>
<br>
On 2014-10-15 15:52, jill wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I would point out that fail2ban is a script that scours auth.log (as<br>
root) for failed authentications, parses out the source host field,<br>
then runs iptables (as root) to add rules for that host. Especially<br>
in light of things like shell shock, think what an attacker could do<br>
with a crafted packet that caused that log line to include malicious<br>
commands in the host field. You're better off properly hardening sshd<br>
itself.<br>
<br>
White list in hosts.allow client ips/domains you will be connecting<br>
from and block all others if at all possible.<br>
Set your sshd_config to:<br>
Never ever allow root login. Ever.<br>
Whitelist explicitly what users/groups can connect on ssh.<br>
Disable password-based auth and use keys, protect the heck out of your<br>
private key.<br>
<br>
-Jill<br>
<br>
<br>
On 2014-10-15 17:10, Stephen M wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I am trying to learn about ssh and remoting into a computer from out of my<br>
house. I have all the ability to do this but I want to make sure my<br>
desktop is secured. I will basically be either using resources on my<br>
desktop or backing up files to my laptop.<br>
<br>
>From what I have read. denyhosts and fail2ban are the same, the only<br>
difference is fail2ban requires more maintenance and has more options. If<br>
I am just trying to turn my desktop into a file server whats the best<br>
option here?<br>
<br>
--<br>
Stephen Melheim<br>
<a href="tel:602-400-7707" value="+16024007707" target="_blank">602-400-7707</a><br>
<a href="mailto:SMelheim85@gmail.com" target="_blank">SMelheim85@gmail.com</a><br>
------------------------------<u></u>---------------------<br>
PLUG-discuss mailing list - <a href="mailto:PLUG-discuss@lists.phxlinux.org" target="_blank">PLUG-discuss@lists.phxlinux.<u></u>org</a><br>
To subscribe, unsubscribe, or to change your mail settings:<br>
<a href="http://lists.phxlinux.org/mailman/listinfo/plug-discuss" target="_blank">http://lists.phxlinux.org/<u></u>mailman/listinfo/plug-discuss</a><br>
</blockquote>
<br>
<br>
------------------------------<u></u>---------------------<br>
PLUG-discuss mailing list - <a href="mailto:PLUG-discuss@lists.phxlinux.org" target="_blank">PLUG-discuss@lists.phxlinux.<u></u>org</a><br>
To subscribe, unsubscribe, or to change your mail settings:<br>
<a href="http://lists.phxlinux.org/mailman/listinfo/plug-discuss" target="_blank">http://lists.phxlinux.org/<u></u>mailman/listinfo/plug-discuss</a><br>
</blockquote>
------------------------------<u></u>---------------------<br>
PLUG-discuss mailing list - <a href="mailto:PLUG-discuss@lists.phxlinux.org" target="_blank">PLUG-discuss@lists.phxlinux.<u></u>org</a><br>
To subscribe, unsubscribe, or to change your mail settings:<br>
<a href="http://lists.phxlinux.org/mailman/listinfo/plug-discuss" target="_blank">http://lists.phxlinux.org/<u></u>mailman/listinfo/plug-discuss</a><br>
</div></div></blockquote></div><br></div>