Re: wish list

["Anthony D. Urso" <anthonyu@killa.net>]

On Mon, Jun 07, 1999 at 12:39:58AM +0200, Pere Camps wrote:
> 	I think that even only if you have one service open, then it's
> pretty useless to have a single-firewalled host.
> 
> 	It's much more esasir to simply comment out a service in inetd and
> add the proper line in /etc/hosts.allow.
> 

Essentially, hosts.deny only protects if the daemon is forked from inetd
with tcpd, or the daemon is compiled with the tcp wrapper libraries.
Either way will lay in a performance hit with each connection.

xinetd and/or proper ipchains filtering are more suitable solutions,
respectively, for most systems.

Also, ipchains rules are not in themselves a firewall, they just
instruct the kernel to deny or drop packets.  No proxying is done.

-- 
 Au

PGP Key ID: 0x385B44CB
Fingerprint: 9E9E B116 DB2C D734 C090  E72F 43A0 95C4 385B 44CB
       lottery(n): A tax on people who are bad at math.
-
Securedistros: A common list for all secured Linux distributions
Archive:       http://humbolt.nl.linux.org/lists/