Hosts.deny, Fail2ban Etc.

Home » CentOS » Hosts.deny, Fail2ban Etc.
CentOS 12 Comments

|Running CentOS 7. I was under the impression – seemingly mistaken – that by adding a rule to /etc/hosts.deny such as ALL: aaa.bbb.ccc.* would ban all attempts from that network segment to connect to the server, ie before fail2ban would (eventually) ban connection attempts.

This, however, does not seem correct and I could use a pointer to correct my misunderstanding. How is hosts.deny used and what have I missed?

Is it necessary to run:

 iptables -I INPUT -s aaa.bbb.ccc.0/24 -j DROP

to drop incoming connection attempts from that subnet?

Thank you!
|

12 thoughts on - Hosts.deny, Fail2ban Etc.

  • hosts.deny is only used by specific programs that use TCP wrappers. It is not a general “deny this host access”.

    Also note that fail2ban operates on individual hosts, not subnets.

    If you use iptables yes, probably. Firewalld has a specific drop zone that you can use:

    firewall-cmd –zone=drop –add-source=aaa.bbb.ccc.0/24

    (with suitable –permanent flag if you want it permanent).

    P.

  • yes. iptables is one of the first things which will see the packets coming to the server as it is implemented in kernel space. hosts.deny only comes in for specific services which are compiled to use it.

    [Internet] <-> [iptables] <-> [systemd if used] <-> [xinetd w/tcp-wrappers]

    In the above example, a packet coming from the internet gets interpreted and dealt with multiple tools and hosts.deny is only used in the last section where xinetd and similar programs compiled with tcp-wrappers look at hosts.deny file.

  • [I should have waited and read all my email before responding. Peter covered parts I did not.]

  • Upstream openssh dropped support for tcp wrappers (hosts.deny) a while ago but RHEL had patched support back in for a while, but I believe it isn’t supported anymore. For what it’s worth, if you use the fail2ban-firewalld package, it uses ipset rather than iptables, which is more efficient.

    —
    Jonathan Billings

  • That’s in CentOS 7 though. CentOS 8 firewalld uses nft instead of the older netfilter (iptables/ipset) code.

    —
    Jonathan Billings

  • TCP wrappers (hosts.allow/deny) are deprecated now.

    Its still supported in EL7 (sshd example)

    ldd /usr/sbin/sshd |grep wrap libwrap.so.0 => /lib64/libwrap.so.0 (0x00007fcc483ee000)

    but not in EL8 anymore. EL8 is based on F28/29 ->
    https://fedoraproject.org/wiki/Changes/Deprecate_TCP_wrappers

    For the question above (for EL7):
    only services that are compiled against libwrap uses hosts.deny everything else will be reachable (if iptables does not drop it).

    For EL8, as depicted in the above URI:
    systemd provide a similar functionality …

    —
    Leon

  • Is that an improvement? I’m still running CentOS7 so I’m not familiar with it.