Re: why is xinetd not installed by default in FC6?

Jeff Vian wrote:
On Tue, 2006-11-21 at 20:59 -0600, Paul Johnson wrote:
One security tip I got years ago was to turn off all access by setting
the file /etc/hosts.deny like this:

ALL:ALL


And then in /etc/hosts.allow, I allow in only specific services and
specific ip address ranges that I want to allow. For example, I
usually allow only ssh connections from a few specific places:

ALL: 127.0.0.1
sshd: 24.124.
sshd: 129.237.
sshfwd-X11: 24.124.
sshfwd-X11: 129.237.

This has served me well to keep out other users and protect myself
from starting services that I don't want.

Now in FC6 I notice that xinetd is not installed and so these host
files have no effect. of course, I can install xinetd, but I'm
suspecting that the FC6 designers want me to do something else in
order to control access. How does one achieve the same effect without
using xinetd?

Maybe iptables?
Iptables can certainly be configured to do what you have listed above,
but not IMHO as easily nor as cleanly. The syntax is different and so
somewhat harder to use.

However, that seems like throwing the baby out with the bathwater. I
would think that having tcpwrappers (which is what uses the hosts.deny
and hosts.allow files) in effect was a good thing.


yum install firestarter

--

Steve

--
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list

Relevant Pages

  • Re: why is xinetd not installed by default in FC6?
    ... Now in FC6 I notice that xinetd is not installed and so these host ... of course, I can install xinetd, but I'm ... suspecting that the FC6 designers want me to do something else in ... Iptables can certainly be configured to do what you have listed above, ...
    (Fedora)
  • Help is needed
    ... Re: IPTables won't start ... high resolution timer ... RPM database question ... Can you not just try and install the shared objects. ...
    (Fedora)
  • Re: Feedback solicited - best way to harden a mail/web server?
    ... Was the system protected by a properly configured firewall? ... it's not a bad "starting point" and it can generate an IPtables rule ... > nor is there a web or ftp server; aside from that I haven't tried to secure ... Before I'll install some nifty application ...
    (comp.os.linux.security)
  • Re: Connection to SonicWall VPN through Linux IPTABLES Firewall/Proxy
    ... I would never install something I didn't ... from the LAN and does NAT to provide access to the Internet to the ... What iptables is doing is taking packets from the LAN, ...
    (comp.security.firewalls)
  • Re: iptables and DHCP
    ... > daemon is hooking the packets before iptables sees them. ... I've stopped dhcpd listening on this interface for now. ... :-) This is the first time in about 4 years that I've had a windows OS ... couple of hours to install it. ...
    (uk.comp.os.linux)