yes, you generally need to include the daemons name, but when i said link, i ment when compiling the program needs to have been compiled with support for tcpwrappers, which means it gets linked to libwrap.a =). Just sticking "mydaemon: ALL: ip" will not work if the application does not support tcpwrappers. I don't recommend tcpwrappers because of this issue, and instead recommend iptables as it will allways work. -miah <div>On 3/28/06, Tom Foucha <<a href="mailto:tom.foucha@neoaccel.com">tom.foucha@neoaccel.com</a>> wrote:<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> <div style="direction: ltr;"> <div> To make the TCP Wrappers active you must as –miah stated link it to the deamon. Example allow: <application/daemon> : <ip address> : allow vsftpd : x.x.x.x : allow You could also put a deny all at the end of the hosts.allow list instead of using the hosts.deny file since the hosts.allow file is applied before hosts.deny vsftpd : ALL : deny --good luck <div> <div style="text-align: center;" align="center"> <hr align="center" size="2" width="100%"> </div> From: <a href="mailto:rhn-users-bounces@redhat.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"> rhn-users-bounces@redhat.com</a> [mailto:<a href="mailto:rhn-users-bounces@redhat.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">rhn-users-bounces@redhat.com</a>] On Behalf Of x6d696168 . Sent: Tuesday, March 28, 2006 4:02 PM</div><div style="direction: ltr;"> To: Red Hat Network Users List Subject: Re: [rhn-users] I need help with hosts.deny - doesn't work asIexpected</div><div style="direction: ltr;"> </div></div><div style="direction: ltr;"> No, thats wrong. TCP Wrappers only protects programs that are linked against libwrap. Xinetd provides a similar filtering functionality, but it doesn't require tcpwrappers, but it only protects applications running via xinetd. IPtables is the best way to go, since its kernel based and can handle anything you throw at it, and doesn't require tcpwrappers, or xinetd since it sits above them. -miah <div> On 3/28/06, Kvetch <<a href="mailto:kvetch@gmail.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">kvetch@gmail.com</a>> wrote: <div> try testing using an IP you have access to. You can log attempts by doing something like this in your wrappers ALL: <a href="http://219.106.229.178" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">219.106.229.178</a> : spawn /bin/echo `/bin/date` access denied>>/var/log/messages : deny I haven't done this in a while so you might want to do a google on logging tcp wrappers If this doesn't give you what you want you might try using iptables, since wrappers only protects against services under xinetd. Nick Baronian <div> On 3/28/06, Bill Watson <<a href="mailto:bill@magicdigits.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"> bill@magicdigits.com</a>> wrote: <div> <div> I did a: </div> <div> service vsftpd stop </div> <div> service vsftpd start </div> <div> </div> <div> and the non-stop hacking on vsftpd stopped. Could be one of 2 things, either this solved my problem permanently, or stopping the service for a few seconds caused his automatic hack program to hang. Dunno which for now, nor know how to tell which did it. Is stuff nuked by hosts.deny logged somewhere? </div> <div> </div> <div> Thanks for you help! </div> <div> Bill </div> <blockquote style="margin-top: 5pt; margin-right: 0in; margin-bottom: 5pt;"> <div> -----Original Message----- From: <a href="mailto:rhn-users-bounces@redhat.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">rhn-users-bounces@redhat.com</a> [mailto:<a href="mailto:rhn-users-bounces@redhat.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"> rhn-users-bounces@redhat.com</a>] On Behalf Of Kvetch </div> <div> Sent: Tuesday, March 28, 2006 11:26 AM To: Red Hat Network Users List Subject: Re: [rhn-users] I need help with hosts.deny - doesn't work asIexpected </div> </blockquote> </div> <div> tcp wrappers are automatic and no service needs restarting. Try restarting vsftd then try again. If you have nothing in your hosts.allow and in your hosts.deny you have ALL: <a href="http://219.106.229.178/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">219.106.229.178</a> ALL: <a href="http://72.129.200.46/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">72.129.200.46</a> ALL: 200.38. ALL: 64.182. It should block them. Can you retest? Nick Baronian <div> On 3/28/06, Bill Watson <<a href="mailto:bill@magicdigits.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">bill@magicdigits.com</a>> wrote: <div> <div> Yes I do have tcp_wrappers=YES in vsftpd.conf </div> </div> <div> <div> </div> <div> Bill </div> </div> <div> <blockquote style="margin-top: 5pt; margin-right: 0in; margin-bottom: 5pt;"> -----Original Message----- From: <a href="mailto:rhn-users-bounces@redhat.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">rhn-users-bounces@redhat.com</a> [mailto:<a href="mailto:rhn-users-bounces@redhat.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"> rhn-users-bounces@redhat.com</a>] On Behalf Of Kvetch Sent: Tuesday, March 28, 2006 10:56 AM To: Red Hat Network Users List Subject: Re: [rhn-users] I need help with hosts.deny - doesn't work as Iexpected Do you have tcp_wrappers=YES in your vsftpd.conf? Nick Baronian <div> On 3/28/06, Bill Watson <<a href="mailto:bill@magicdigits.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">bill@magicdigits.com </a>> wrote: I have /etc/hosts.allow that has no entries. I have /etc/hosts.deny that has: ALL: <a href="http://219.106.229.178" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">219.106.229.178</a> ALL: <a href="http://72.129.200.46" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">72.129.200.46</a> ALL: 200.38. ALL: 64.182. >From my readings, I should not be getting any messages from 200.38.x.x, yet my /var/log/messages shows: Mar 28 10:50:36 helmethouse vsftpd(pam_unix)[23790]: check pass; user unknown Mar 28 10:50:36 helmethouse vsftpd(pam_unix)[23790]: authentication failure; log name= uid=0 euid=0 tty= ruser= rhost=<a href="http://200.38.16.6" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">200.38.16.6</a> Mar 28 10:50:40 helmethouse vsftpd(pam_unix)[23790]: check pass; user unknown Mar 28 10:50:40 helmethouse vsftpd(pam_unix)[23790]: authentication failure; log name= uid=0 euid=0 tty= ruser= rhost=<a href="http://200.38.16.6" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">200.38.16.6</a> And keeps going with a new entry every few seconds. Is /etc/hosts.deny properly set up? Is /etc/hosts.deny immediately active or must some service be restarted to make it go? Does vsftpd bypass /etc/hosts.deny? Thanks! Bill Watson <a href="mailto:bill@magicdigits.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">bill@magicdigits.com</a> _______________________________________________ rhn-users mailing list <a href="mailto:rhn-users@redhat.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">rhn-users@redhat.com</a> <a href="https://www.redhat.com/mailman/listinfo/rhn-users" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">https://www.redhat.com/mailman/listinfo/rhn-users</a> </div> </blockquote> </div> _______________________________________________ rhn-users mailing list <a href="mailto:rhn-users@redhat.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">rhn-users@redhat.com</a> <a href="https://www.redhat.com/mailman/listinfo/rhn-users" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">https://www.redhat.com/mailman/listinfo/rhn-users</a> </div> </div> _______________________________________________ rhn-users mailing list <a href="mailto:rhn-users@redhat.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">rhn-users@redhat.com</a> <a href="https://www.redhat.com/mailman/listinfo/rhn-users" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">https://www.redhat.com/mailman/listinfo/rhn-users</a> </div> </div> _______________________________________________ rhn-users mailing list <a href="mailto:rhn-users@redhat.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">rhn-users@redhat.com</a> <a href="https://www.redhat.com/mailman/listinfo/rhn-users" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">https://www.redhat.com/mailman/listinfo/rhn-users</a> </div> </div><div style="direction: ltr;"> </div> This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission. If verification is required please request a hard-copy version. NeoAccel, Inc., 2055 Gateway Place #240, San Jose, CA. 95110 (408) 436-1000 </div> _______________________________________________ rhn-users mailing list <a onclick="return top.js.OpenExtLink(window,event,this)" href="mailto:rhn-users@redhat.com">rhn-users@redhat.com</a> <a onclick="return top.js.OpenExtLink(window,event,this)" href="https://www.redhat.com/mailman/listinfo/rhn-users" target="_blank"> https://www.redhat.com/mailman/listinfo/rhn-users</a> </blockquote></div>