Re: [gentoo-security] hosts.{allow,deny} vs. iptables.

[Kevin Enslow]

One reason I can think of is to keep it simple across platforms.
tcpd is, in general OS non-specific. When you need to make security
suggestions that span platforms (Linux, Solaris, BSD, etc) this is what
you want. You can install tcpd on all platforms, and the configuration
is the same. 

iptables is Linux specific. To create the same functionallity on other 
platforms, you will be stuck with several different packages and config 
files to provide the same functionallity. This can become hard to manage 
very quickly.



.------[ Peter Volkov wrote (2005/10/13 at 12:32:05 AM) ]------
 | 
> Hello.
>
> Can anybody explain the differences, pro/con between the mentioned two
> approaches in the subject?
>
> I thought that fewer programs I have on my server the more secure it is.
> But gentoo security guide and some people on this list suggest usage of
> hosts.allow, hosts.deny files, which only work if I have tpcd installed,
> thus another service which weaken server's security. But normaly each
> server has iptables installed. So every sysadmin can obtain hosts.allow,
> hosts.deny functionality with simple iptables rule like the following:
>
> iptables -A INPUT -s bad_host -j DROP
>
> This is the base functionality of iptables. No PoM is nescesary for such
> kind of things.
>
> More. I think some portable bash script that will parse host.* files and
> create iptables rules is very simple to write!
>
> So why many people and security guides still suggest the use of tcpd
> over simple iptables rules?
>
> Thank you for your time,
> Peter.


|
`^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^


-- 
-- 
gentoo-security@g.o mailing list