Daemons for hosts.allow and hosts.deny?

I want to use hosts.allow and hosts.deny to restrict access to my servers, but I'm not sure what daemons to use in the config files for services like remote desktop or server admin. Is there any way to specify those services? Can you do it with port numbers instead of service names (man 5 hosts_access wasn't very clear to me).
For services like http and ssh, its a no-brainer, but I can't figure out the Apple specific stuff.
Thanks,
Miles
11 G4 XServes... Mac OS X (10.4.5)

If you are referring to the python script, "denyhosts" that works in conjunction with xinetd, this simply works under 10.3.x, I've used it once successfully. It needs to be configured correctly, but it does work. Did not try it with 10.4, but...
the far better option is described by Leland.

Similar Messages

What is the screen for 'AETC / Allowances and Charges' DFF ?

Hi All,
I need to know in which screen/form is the DFF "AETC / Allowances and Charges" (Application : Order Management) located ?
Thanks in Advance!

Aloha, Lorna, me, the Kraut again...
the resolution of a movie project is independent of its content, or where the pictures/clips/videos come from…
iM is meant by concept to deliver to TV, by tape or DVD…
so limits are set by your video standard, which is NTSC, which has 720x480 pixels.
have a look at Dan's phantastic website:
http://danslagle.com/mac/iMovie/video/2002.shtml
http://danslagle.com/mac/iMovie/video/2003.shtml
… as far as I understand, that answers Q2 too, right...? all screens same size…
and, search at amazon.com (or at your local library/bookstore) for
David Pogue/The Missing Manual....
zillions of tipps&hints&easy to read how-tos

Provisioning Allowed and Allow Auto-provisioning YES Role exists No

Hello,
I am unable to select the roles while submitting the user provisioning request.
The role additional details are set Yes for Provisioning Allowed and Allow Auto-provisioning
But Role exists is showing No; i have tried updating the roles in many ways, everything is getting updated except this paricular field.
Could you pls help me ...
Regards,
Sumanth

Hello Sumanth,
Can you successfully generate roles using the role generation option?
I have the same issue but I presently have issues with generating single roles ONLY as posted on this thread - "Illegal tcodes" error during the role generation phase of ERM in AC10
...so I am thinking it is becuase I can't generate single roles that is why the roles are not displaying. However, I can view the roles in other environments like risk analysis but not at the point of access request provisioning. It tells me no roles are available.
I sure hope someone will be able to help us out.
Thanks

Sshd ignores /etc/hosts.allow and /etc/hosts.deny

Hello everyone,
I've just found out that sshd ignores /etc/hosts.allow and /etc/hosts.deny completely on my machine. It doesn't make use of tcp_wrappers. I am using the standard Arch package. Either my settings are wrong, or this is a severe security problem. It was a terrible surprise to find out that my server is under severe dictionary attacks all the time, despite the denyhosts script I am using.
These are my settings:
/etc/hosts.deny:
ALL: ALL
/etc/hosts.allow:
# some nfs daemons: 192.168.1.0/255.255.255.0
sshd sshd1 sshd2: ALL EXCEPT /etc/hosts.evil
mysqld: 192.168.1.0/255.255.255.0
/etc/hosts.evil:
195.113.21.131
60.10.6.53
A simple experiment to verify the settings:
[root@charon etc]# tcpdmatch -d -i /etc/xinetd.conf sshd 195.113.21.131
warning: sshd: no such process name in /etc/xinetd.conf
client: address 195.113.21.131
server: process sshd
matched: hosts.deny line 5
access: denied
[root@charon etc]# tcpdmatch -d -i /etc/xinetd.conf sshd 195.113.21.130
warning: sshd: no such process name in /etc/xinetd.conf
client: address 195.113.21.130
server: process sshd
matched: hosts.allow line 10
access: granted
This seems to be fine. But when I go to the machine 195.113.21.131, I can simply log in with no trouble at all.
This is really strange. Does it have something to do with the xinetd warning? I am not using xinetd... Maybe I'm doing something wrong. If you have experienced such a trouble, please give me a hint.

elasticdog wrote:So should our package not have the ListenAddress 0.0.0.0 line uncommented by default? My guess would be that since it listens on all local addresses by default, we're just overwriting that when specifying 0.0.0.0, which isn't valid. That was users don't have to specify their local IP address. Unless I'm wrong, shouldn't this be a bug/feature request for the packager?
This doesn't seem to be a package bug... IMHO, sshd must respect all the settings in hosts.deny and hosts.allow, regardless the IP address it listens on. The behaviour I noticed seems to be much more complicated. Basic settings (daemon name mentioned in hosts.*) worked, as far as I didn't want a "per IP" configuration. For example, including the daemon in hosts.allow really enabled remote connections, but any closer specifications (subdomains, EXCEPT operator...) were ignored. Access was simply granted without further evaluation. Excluding sshd from hosts.allow worked as one would assume. When I specified ListenAddress, everything started to work properly. This is mysterious. There are millions of computers using tcp wrappers and ssh, so it's hard to believe there could be a bug.

[SOLVED] how do hosts.allow and hosts.deny work?

I understand the basic concepts of hosts.allow and hosts.deny, but I am interested in how it works. What actually blocks access to the services? Do they do it themselves? Or it is something in the kernel that does it?
For example, if I have this in my hosts.allow:
sshd:all
#mysqld: all
And this is my hosts.deny:
ALL: ALL: DENY
This will result in people being able to connect to sshd but not mysqld. Are sshd and mysqld programmed to read these hosts.allow and hosts.deny files? Or is there something stopping the connection before it even gets to the daemon?
The hosts.allow and hosts.deny man pages refer to tcpd, but it is not running on my system. Also, hosts.allow and hosts.deny never show up in the output of `lsof`. hosts.allow and hosts.deny belong to the tcp_wrappers package, but there is nothing else in the package that illuminates my question.
Last edited by partner55083777 (2010-03-15 12:35:51)

Thanks guys.
However most common network service daemons today can be linked against libwrap directly.
Sure enough,
$ ldd /usr/sbin/sshd
linux-vdso.so.1 => (0x00007123451ff000)
libwrap.so.0 => /usr/lib/libwrap.so.0 (0x00007fffbd6d000)
libpam.so.0 => /lib/libpam.so.0 (0x00007f99765f1000)
$
Here is also a little bit more information about libwrap:
http://en.wikipedia.org/wiki/Libwrap
Last edited by partner55083777 (2010-03-15 20:03:11)

Pure-ftpd setup (hosts.allow & hosts.deny)

hello,
i have installed pure-ftpd. i have it in daemon section in rc.conf and it's working (wisible from outside) althought my /etc/hosts.deny is
ALL: ALL: DENY
and in /etc/hosts.allow isn't any notice about pure-ftpd (just sshd).
isn't that weird?
thanx for answers.

If your version of pure-ftpd was build without tcpwrappers, but might explain it.

[Solved] hosts.deny vs. hosts.allow

Hi,
I was looking for some detailed documentation about hosts.deny and hosts.allow. I have a vague idea that this is what is called "tcp wrappers", but I'm not sure. Can someone point me to some relevant documentation? I couldn't find anything in the wiki.
Last edited by kikinovak (2011-01-22 08:51:28)

man 5 hosts_access
And yes, it is tcp_wrappers.

Port speed for ISL's and SP's , Hosts (MDS 9513)

Is there any recommendation/best practise for
1) setting port speed ie choose Auto or hard code eg 2gb, 4gb wrt b/w available ?
2) ratemode ie dedicated or shared ?
For ISL's And Storage processors/Controllers and hosts
Thanks,

For ISL's, if the line card is gen2, it must be configured as dedicated. For the port mode, I would recommend that you hard code the mode to E. I also like to code the speed on ISLs so that there is no chance that they would negotiate to a slower speed. IE: you don't want to have a 2GB link negotiate at 1GB.
As for storage controllers, depending on the fan in ratio, I would recommend hard coding them to the device speed, and if the port-group has the bandwidth available, make them dedicated.
As for hosts, they should be on the shared port, and I would leave them as port mode = auto. This way they can negotiate F or FL. You might want to configure a 'maximum allowable auto speed setting'.
IE: if your hosts have 2GB HBAs, and are plugged into a 4GB capable port, they will never negotiate to 4GB...so why have the MDS think it needs to keep some bandwidth for that port (in shared mode). I forget the command, but there is way to set auto-max for the port speed on shared ports.
Hope this helps,
Mike

When will skype for android allow me to host a gro...

when will skype for android allow me to host a group call? I know when using skype on a mobile device, I can join and participate in group calls but I cannot host one. Just wondering if that will ever be enabled for mobile device users?

yes, if you had a micro sim and had got some data plans in it, then go head---your ipad can use the cellular internet.

Best Practice for Host Named Site Collections and Web Apps

Looking for advice on setting up the host named site collections. If I am reading many of the technet articles and blogs correctly I should 1) have only 1 top level web app for host named site collections and 2) not have a host header for that web
app. If that's correct I am looking for advice. We have 7 separate domains that we support in our farm. Currently each of those domains is divided into web applications based on the domain, *.contoso, *.trains.com, *.bakers.com, etc.
Is the concept now that all of the host named site collections fall under that one web app? How do we deal with the SSL for each of those separate domains which all have their own certificates?
Thanks in advance for your comments.
NLewis

Yes, for creating host named site collections, first you create a host header less web app and then create host named site collections under that web app. However this is only for the cases where all the host named site collections ends in one domain. So
you can create host named site collections as intranet.contoso.com, my.contoso.com, portal.contoso.com etc as they are all ending in *.contoso.com.
As per your environment, if you have web apps which caters to different domains like *.contoso.com, *.trains.com, *.bakers.com, you need to create separate web apps as they are all ending in different domains. Then you can have a separate wildcard SSL certificate
for each of those web apps.
Hope this helps.
Thanks
Mohit

HT201320 I use my college's email address through outlook and I don't know what you use for the incoming and outgoing host?

My email is though the college where I work. We use Outlook, and I am trying to set up my email but I am not sure what to use for my incoming and outgoing host information.

Ask your college. Most likely the same settings as you have set in Outlook.

Monitoring template for hosts and listeners

I've created a monitoring template through "setup -> monitoring template -> create". Under the "policies" tab I am unable to locate some policies for hosts and listeners such as "Listener.ora Permission" and "Open Ports". However, I can see (under policy rules library) that those policies are applied to all targets by default. How do I add those policies into my monitor template?
I am using 10.2.0.4 OEM grid control repository and agents on Sun Solaris 10.
Thx.

Hi,
The Hyper-V guest can be specific the Memory weight and total number of CPU, please first confirm you have set the proper value for the vm workload.
You can refer the following step by step Hyper-V performance troubleshooting steps set the performance monitor:
Performance Management: Monitoring CPU Resources….
http://blogs.technet.com/b/chrisavis/archive/2013/03/25/performance-management-monitoring-cpu-resources.aspx
Monitoring Hyper-V Performance
http://blogs.msdn.com/b/tvoellm/archive/2009/04/23/monitoring-hyper-v-performance.aspx
Measuring Performance on Hyper-V
http://msdn.microsoft.com/en-us/library/cc768535(v=bts.10).aspx
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Diagnostic Pack and System monitoring plug-in for host.

Is it correct to say that the ´Operating System Monitoring´ feature of the Oracle DB Diagnostic Pack discards the need of installing a System Monitoring Plug-in for Host in those servers where I have both Oracle DB and Diagnostic Pack for Oracle DB already installed?

On <http://www.oracle.com/us/corporate/pricing/price-lists/index.html> in the technology pricelist
check for "System Monitoring Plug-in for Non Oracle Databases"

Need for Host identification and information connections

I am new in oracle data base 11g, I want to load data from a user file using oracle entreprise manager to my data base schema, but I found the problem of the host identification and information connection (host user and password).I tried to use informations identification of my data base instance but there is an error "invalide username and/or password".
please, help me.

I think the application you are using require the operating system and password that you installed oracle with for example
if you installed oracle using user name :oracle and the password is oraclepass
then give these credentials for the application and let us know the result.
kind regards
Mohamed

Enterprise Deployment for Hosted Devlopment and Production

We are moving from a 11G dev environment to 11g production. We chose Installation scenario#3: Enterprise Deployment for Hosted Development and Production so we could scale out the load to multiple servers. I am at the point now where I need to load my repostory and webcat(dashboard files) and I want to make sure I understand what needs to be done.
Do I load my Repository and Webcat directory on the first node and it deploys it automatically to the 2nd node or are there other steps to do this.
Thanks!

Hi,
I thought about that possibility, but since in the Apple website I read that
"Deploy proprietary, in-house applications to authorized users in your company, the iPhone Developer Enterprise Program is available to companies with 500 or more employees and a Dun & Bradstreet number."
Since I'm freelancer,I don't have 500 employees, neither the Dun & Bradstreet number.
Can I subscribe to the program in the same way?
Also, if I subscribe the Enterprise program, I can also develop and publish "normal" apps for the iTunes, or do I need to have another subscription?
Best regards and thanks for the fast answers
Paulo Correia

Daemons for hosts.allow and hosts.deny?

Similar Messages

Maybe you are looking for