quoth the Peter Volkov: > Hello. > > Can anybody explain the differences, pro/con between the mentioned two > approaches in the subject? > > I thought that fewer programs I have on my server the more secure it is. > But gentoo security guide and some people on this list suggest usage of > hosts.allow, hosts.deny files, which only work if I have tpcd installed, > thus another service which weaken server's security. But normaly each > server has iptables installed. So every sysadmin can obtain hosts.allow, > hosts.deny functionality with simple iptables rule like the following: > > iptables -A INPUT -s bad_host -j DROP > > This is the base functionality of iptables. No PoM is nescesary for such > kind of things. > > More. I think some portable bash script that will parse host.* files and > create iptables rules is very simple to write! > > So why many people and security guides still suggest the use of tcpd > over simple iptables rules? > > Thank you for your time, > Peter.
This is a good question, and one for which I am anticipating many responses more informative and comprehensive than mine...all I can do is offer opinion. As I see it, iptables is best used to guard the network gateway, and live internet servers, ie: http, ftp, smtp, named etc...and tcpwrappers is best suited for internal LAN security, where you may want to easily control access to _many_ services host by host, ie NFS, samba, rsync, ssh, pop, imap etc... I suppose the listing of services is arbitrary, depending on your circumstances. For me it comes down to iptables for servers directly accessable from the internet, and tcpwrappers for internal stuff. -d -- darren kirby :: Part of the problem since 1976 :: http://badcomputer.org "...the number of UNIX installations has grown to 10, with more expected..." - Dennis Ritchie and Ken Thompson, June 1972
pgpj0c4IpVa7l.pgp
Description: PGP signature
