1#
2# hosts.allow access control file for "tcp wrapped" applications.
| 1#
2# hosts.allow access control file for "tcp wrapped" applications.
|
3# $FreeBSD: head/etc/hosts.allow 60031 2000-05-05 08:31:59Z sheldonh $
| 3# $FreeBSD: head/etc/hosts.allow 63515 2000-07-19 13:05:58Z ume $
|
4#
5# NOTE: The hosts.deny file is deprecated.
6# Place both 'allow' and 'deny' rules in the hosts.allow file.
7# See hosts_options(5) for the format of this file.
8# hosts_access(5) no longer fully applies.
9
10# _____ _ _
11# | ____| __ __ __ _ _ __ ___ _ __ | | ___ | |
12# | _| \ \/ / / _` | | '_ ` _ \ | '_ \ | | / _ \ | |
13# | |___ > < | (_| | | | | | | | | |_) | | | | __/ |_|
14# |_____| /_/\_\ \__,_| |_| |_| |_| | .__/ |_| \___| (_)
15# |_|
16# !!! This is an example! You will need to modify it for your specific
17# !!! requirements!
18
19
20# Start by allowing everything (this prevents the rest of the file
21# from working, so remove it when you need protection).
22# The rules here work on a "First match wins" basis.
23ALL : ALL : allow
24
25# Wrapping sshd(8) is not normally a good idea, but if you
26# need to do it, here's how
27#sshd : .evil.cracker.example.com : deny
28
29# Prevent those with no reverse DNS from connecting.
30ALL : PARANOID : RFC931 20 : deny
31
32# Allow anything from localhost. Note that an IP address (not a host
33# name) *MUST* be specified for portmap(8).
34ALL : localhost 127.0.0.1 : allow
35ALL : my.machine.example.com 192.0.2.35 : allow
36
| 4#
5# NOTE: The hosts.deny file is deprecated.
6# Place both 'allow' and 'deny' rules in the hosts.allow file.
7# See hosts_options(5) for the format of this file.
8# hosts_access(5) no longer fully applies.
9
10# _____ _ _
11# | ____| __ __ __ _ _ __ ___ _ __ | | ___ | |
12# | _| \ \/ / / _` | | '_ ` _ \ | '_ \ | | / _ \ | |
13# | |___ > < | (_| | | | | | | | | |_) | | | | __/ |_|
14# |_____| /_/\_\ \__,_| |_| |_| |_| | .__/ |_| \___| (_)
15# |_|
16# !!! This is an example! You will need to modify it for your specific
17# !!! requirements!
18
19
20# Start by allowing everything (this prevents the rest of the file
21# from working, so remove it when you need protection).
22# The rules here work on a "First match wins" basis.
23ALL : ALL : allow
24
25# Wrapping sshd(8) is not normally a good idea, but if you
26# need to do it, here's how
27#sshd : .evil.cracker.example.com : deny
28
29# Prevent those with no reverse DNS from connecting.
30ALL : PARANOID : RFC931 20 : deny
31
32# Allow anything from localhost. Note that an IP address (not a host
33# name) *MUST* be specified for portmap(8).
34ALL : localhost 127.0.0.1 : allow
35ALL : my.machine.example.com 192.0.2.35 : allow
36
|
| 37# To use IPv6 addresses you must enclose them in []'s
38ALL : [fe80::%fxp0]/10 : allow
39ALL : [fe80::]/10 : deny
40ALL : [3ffe:fffe:2:1:2:3:4:3fe1] : deny
41ALL : [3ffe:fffe:2:1::]/64 : allow
42
|
37# Sendmail can help protect you against spammers and relay-rapers
38sendmail : localhost : allow
39sendmail : .nice.guy.example.com : allow
40sendmail : .evil.cracker.example.com : deny
41sendmail : ALL : allow
42
43# Exim is an alternative to sendmail, available in the ports tree
44exim : localhost : allow
45exim : .nice.guy.example.com : allow
46exim : .evil.cracker.example.com : deny
47exim : ALL : allow
48
49# Portmapper is used for all RPC services; protect your NFS!
50# (IP addresses rather than hostnames *MUST* be used here)
51portmap : 192.0.2.32/255.255.255.224 : allow
52portmap : 192.0.2.96/255.255.255.224 : allow
53portmap : ALL : deny
54
55# Provide a small amount of protection for ftpd
56ftpd : localhost : allow
57ftpd : .nice.guy.example.com : allow
58ftpd : .evil.cracker.example.com : deny
59ftpd : ALL : allow
60
61# You need to be clever with finger; do _not_ backfinger!! You can easily
62# start a "finger war".
63fingerd : ALL \
64 : spawn (echo Finger. | \
65 /usr/bin/mail -s "tcpd\: %u@%h[%a] fingered me!" root) & \
66 : deny
67
68# The rest of the daemons are protected.
69ALL : ALL \
70 : severity auth.info \
71 : twist /bin/echo "You are not welcome to use %d from %h."
| 43# Sendmail can help protect you against spammers and relay-rapers
44sendmail : localhost : allow
45sendmail : .nice.guy.example.com : allow
46sendmail : .evil.cracker.example.com : deny
47sendmail : ALL : allow
48
49# Exim is an alternative to sendmail, available in the ports tree
50exim : localhost : allow
51exim : .nice.guy.example.com : allow
52exim : .evil.cracker.example.com : deny
53exim : ALL : allow
54
55# Portmapper is used for all RPC services; protect your NFS!
56# (IP addresses rather than hostnames *MUST* be used here)
57portmap : 192.0.2.32/255.255.255.224 : allow
58portmap : 192.0.2.96/255.255.255.224 : allow
59portmap : ALL : deny
60
61# Provide a small amount of protection for ftpd
62ftpd : localhost : allow
63ftpd : .nice.guy.example.com : allow
64ftpd : .evil.cracker.example.com : deny
65ftpd : ALL : allow
66
67# You need to be clever with finger; do _not_ backfinger!! You can easily
68# start a "finger war".
69fingerd : ALL \
70 : spawn (echo Finger. | \
71 /usr/bin/mail -s "tcpd\: %u@%h[%a] fingered me!" root) & \
72 : deny
73
74# The rest of the daemons are protected.
75ALL : ALL \
76 : severity auth.info \
77 : twist /bin/echo "You are not welcome to use %d from %h."
|