hosts.allow revision 56585 
1#
2# hosts.allow access control file for "tcp wrapped" applications.
3# $FreeBSD: head/etc/hosts.allow 56585 2000-01-25 11:25:59Z obrien $
4#
5# NOTE: The hosts.deny file is no longer used.
6#       Instead, put both 'allow' and 'deny' rules in the hosts.allow file.
7#	See hosts_options(5) for the format of this file.
8#	hosts_access(5) no longer fully applies.
9
10#	 _____                                      _          _ 
11#	| ____| __  __   __ _   _ __ ___    _ __   | |   ___  | |
12#	|  _|   \ \/ /  / _` | | '_ ` _ \  | '_ \  | |  / _ \ | |
13#	| |___   >  <  | (_| | | | | | | | | |_) | | | |  __/ |_|
14#	|_____| /_/\_\  \__,_| |_| |_| |_| | .__/  |_|  \___| (_)
15#					   |_|                   
16# !!! This is an example! You will need to modify it for your specific
17# !!! requirements!
18
19
20# Start by allowing everything (this prevents the rest of the file
21# from working, so remove it when you need protection).
22# The rules here work on a "First match wins" basis.
23ALL : ALL : allow
24
25# Wrapping sshd(8) is not normally a good idea, but if you
26# need to do it, here's how
27#sshd : .evil.cracker.example.com : deny 
28
29# Prevent those with no reverse DNS from connecting.
30ALL : PARANOID : RFC931 20 : deny
31
32# Allow anything from localhost
33ALL : localhost : allow
34ALL : my.machine.example.com : allow
35
36# Sendmail can help protect you against spammers and relay-rapers
37sendmail : localhost : allow
38sendmail : .nice.guy.example.com : allow
39sendmail : .evil.cracker.example.com : deny
40sendmail : ALL : allow
41
42# Exim is an alternative to sendmail, available in the ports tree
43exim : localhost : allow
44exim : .nice.guy.example.com : allow
45exim : .evil.cracker.example.com : deny
46exim : ALL : allow
47
48# Portmapper is used for all RPC services; protect your NFS!
49# (IP addresses rather than hostnames *MUST* be used here)
50portmap : localhost : allow
51portmap : .nice.guy.example.com : allow
52portmap : .evil.cracker.example.com : deny
53portmap : ALL : allow
54
55# Provide a small amount of protection for ftpd
56ftpd : localhost : allow
57ftpd : .nice.guy.example.com : allow
58ftpd : .evil.cracker.example.com : deny
59ftpd : ALL : allow
60
61# You need to be clever with finger; do _not_ backfinger!! You can easily
62# start a "finger war".
63fingerd : ALL \
64	: spawn (echo Finger. | \
65	 /usr/bin/mail -s "tcpd\: %u@%h[%a] fingered me!" root) & \
66	: deny
67
68# The rest of the daemons are protected. Backfinger and log by email.
69ALL : ALL \
70	: severity auth.info : spawn (/usr/bin/finger -l @%h | \
71	 /usr/bin/mail -s "tcpd\: %u@%h[%a] tried to use %d  (denied)" root) & \
72	: twist /bin/echo "You are not welcome to use %d from %h."
73