Re: [cobalt-users] new openssl vulnerabilities

[Parker Morse <morse@xxxxxxxxxxx>]

On Tuesday, July 30, 2002, at 11:57  AM, Network Operations wrote:
> how would you used hosts.deny to block all access to port 22 except
> from a list of specified ip's?
>
> Or would hosts.deny even be what you want to use?

You could use hosts.deny with its (evil?) twin, hosts.allow. See "man 
hosts.allow" (or "man hosts.deny") for more details, but here's the key 
part of the man page:

---begin excerpt---
The access control software consults two files. The search stops at the 
first match:

o	Access will be granted when a (daemon,client) pair matches an entry in 
the /etc/hosts.allow file.

o	Otherwise, access will be denied when a (daemon,client) pair matches 
an entry in the /etc/hosts.deny file.

o	Otherwise, access will be granted.

A  non-existing  access  control  file is treated as if it were an empty 
file. Thus, access control can be turned off by providing no access 
control files.

---end excerpt--

So I would try adding your specified IPs to hosts.allow, and then put the 
appropriate "deny all" rule in hosts.deny.

pjm