hosts.allow revision 63515 
1#
2# hosts.allow access control file for "tcp wrapped" applications.
3# $FreeBSD: head/etc/hosts.allow 63515 2000-07-19 13:05:58Z ume $
4#
5# NOTE: The hosts.deny file is deprecated.
6#       Place both 'allow' and 'deny' rules in the hosts.allow file.
7#	See hosts_options(5) for the format of this file.
8#	hosts_access(5) no longer fully applies.
9
10#	 _____                                      _          _ 
11#	| ____| __  __   __ _   _ __ ___    _ __   | |   ___  | |
12#	|  _|   \ \/ /  / _` | | '_ ` _ \  | '_ \  | |  / _ \ | |
13#	| |___   >  <  | (_| | | | | | | | | |_) | | | |  __/ |_|
14#	|_____| /_/\_\  \__,_| |_| |_| |_| | .__/  |_|  \___| (_)
15#					   |_|                   
16# !!! This is an example! You will need to modify it for your specific
17# !!! requirements!
18
19
20# Start by allowing everything (this prevents the rest of the file
21# from working, so remove it when you need protection).
22# The rules here work on a "First match wins" basis.
23ALL : ALL : allow
24
25# Wrapping sshd(8) is not normally a good idea, but if you
26# need to do it, here's how
27#sshd : .evil.cracker.example.com : deny 
28
29# Prevent those with no reverse DNS from connecting.
30ALL : PARANOID : RFC931 20 : deny
31
32# Allow anything from localhost.  Note that an IP address (not a host
33# name) *MUST* be specified for portmap(8).
34ALL : localhost 127.0.0.1 : allow
35ALL : my.machine.example.com 192.0.2.35 : allow
36
37# To use IPv6 addresses you must enclose them in []'s
38ALL : [fe80::%fxp0]/10 : allow
39ALL : [fe80::]/10 : deny
40ALL : [3ffe:fffe:2:1:2:3:4:3fe1] : deny
41ALL : [3ffe:fffe:2:1::]/64 : allow
42
43# Sendmail can help protect you against spammers and relay-rapers
44sendmail : localhost : allow
45sendmail : .nice.guy.example.com : allow
46sendmail : .evil.cracker.example.com : deny
47sendmail : ALL : allow
48
49# Exim is an alternative to sendmail, available in the ports tree
50exim : localhost : allow
51exim : .nice.guy.example.com : allow
52exim : .evil.cracker.example.com : deny
53exim : ALL : allow
54
55# Portmapper is used for all RPC services; protect your NFS!
56# (IP addresses rather than hostnames *MUST* be used here)
57portmap : 192.0.2.32/255.255.255.224 : allow
58portmap : 192.0.2.96/255.255.255.224 : allow
59portmap : ALL : deny
60
61# Provide a small amount of protection for ftpd
62ftpd : localhost : allow
63ftpd : .nice.guy.example.com : allow
64ftpd : .evil.cracker.example.com : deny
65ftpd : ALL : allow
66
67# You need to be clever with finger; do _not_ backfinger!! You can easily
68# start a "finger war".
69fingerd : ALL \
70	: spawn (echo Finger. | \
71	 /usr/bin/mail -s "tcpd\: %u@%h[%a] fingered me!" root) & \
72	: deny
73
74# The rest of the daemons are protected.
75ALL : ALL \
76	: severity auth.info \
77	: twist /bin/echo "You are not welcome to use %d from %h."
78