hosts.allow revision 60031 
1#
2# hosts.allow access control file for "tcp wrapped" applications.
3# $FreeBSD: head/etc/hosts.allow 60031 2000-05-05 08:31:59Z sheldonh $
4#
5# NOTE: The hosts.deny file is deprecated.
6#       Place both 'allow' and 'deny' rules in the hosts.allow file.
7#	See hosts_options(5) for the format of this file.
8#	hosts_access(5) no longer fully applies.
9
10#	 _____                                      _          _ 
11#	| ____| __  __   __ _   _ __ ___    _ __   | |   ___  | |
12#	|  _|   \ \/ /  / _` | | '_ ` _ \  | '_ \  | |  / _ \ | |
13#	| |___   >  <  | (_| | | | | | | | | |_) | | | |  __/ |_|
14#	|_____| /_/\_\  \__,_| |_| |_| |_| | .__/  |_|  \___| (_)
15#					   |_|                   
16# !!! This is an example! You will need to modify it for your specific
17# !!! requirements!
18
19
20# Start by allowing everything (this prevents the rest of the file
21# from working, so remove it when you need protection).
22# The rules here work on a "First match wins" basis.
23ALL : ALL : allow
24
25# Wrapping sshd(8) is not normally a good idea, but if you
26# need to do it, here's how
27#sshd : .evil.cracker.example.com : deny 
28
29# Prevent those with no reverse DNS from connecting.
30ALL : PARANOID : RFC931 20 : deny
31
32# Allow anything from localhost.  Note that an IP address (not a host
33# name) *MUST* be specified for portmap(8).
34ALL : localhost 127.0.0.1 : allow
35ALL : my.machine.example.com 192.0.2.35 : allow
36
37# Sendmail can help protect you against spammers and relay-rapers
38sendmail : localhost : allow
39sendmail : .nice.guy.example.com : allow
40sendmail : .evil.cracker.example.com : deny
41sendmail : ALL : allow
42
43# Exim is an alternative to sendmail, available in the ports tree
44exim : localhost : allow
45exim : .nice.guy.example.com : allow
46exim : .evil.cracker.example.com : deny
47exim : ALL : allow
48
49# Portmapper is used for all RPC services; protect your NFS!
50# (IP addresses rather than hostnames *MUST* be used here)
51portmap : 192.0.2.32/255.255.255.224 : allow
52portmap : 192.0.2.96/255.255.255.224 : allow
53portmap : ALL : deny
54
55# Provide a small amount of protection for ftpd
56ftpd : localhost : allow
57ftpd : .nice.guy.example.com : allow
58ftpd : .evil.cracker.example.com : deny
59ftpd : ALL : allow
60
61# You need to be clever with finger; do _not_ backfinger!! You can easily
62# start a "finger war".
63fingerd : ALL \
64	: spawn (echo Finger. | \
65	 /usr/bin/mail -s "tcpd\: %u@%h[%a] fingered me!" root) & \
66	: deny
67
68# The rest of the daemons are protected.
69ALL : ALL \
70	: severity auth.info \
71	: twist /bin/echo "You are not welcome to use %d from %h."
72