which log files to check for hosts.deny

Similar Threads:

1.slow log in process with /etc/hosts.deny or hosts.allow

I have a linux box running mandrake kernel 2.4.3.  It has xinetd.  I
come to a odd question when I configure /etc/hosts.allow or
/etc/hosts.deny.  No matter what entry I put in, my log in will become
very slow.  However, everything runs normal speed after I login.  This
happens when I sit in front of my computer, romote ssh.  It also happen
when I bring up a Xterm.  The windows will pops out quick but the
prompt comes up very slow.  It happnens when I do the su user.  It
seems to try to find something after I type password.  I use tcpdump
and find this when the system slow.
hostname.631 > xxx.xxx.xxx.255.631 UDP 133 (DF)
hostname.631 > xxx.xxx.xxx.255.631 UDP 134 (DF)
I don't know if it is relative.
I also use to.  I didn't see anything consuming CPU time and memory.
The CPU idle is always about 99%.
I set up serveral linux but never had this kind of problem.  Any idea?

Thank you in advance

2.hosts.deny: how do i test to see if hosts.deny is working

I am trying to block scraper sites from accessing my sites.
I have put a bunch ip addresses in my hosts.deny and I'm not sure if
they've blocked anything.

Then I put my own IP address into the hosts.deny to see if I could
block myself.  that didn't work.

I would like to know if there is a log file  or some other way to
verify that IP's that I've designated in hosts.deny are actually
getting blocked.

Many thanks.

3.Issue with SSH: my IP address doesn't stop to be logged into /etc/hosts.deny

I administer my remote server (Ubuntu 8.04.1 server) with ssh.

For some reasons, the IP address of my work computer has been logged
in /etc/hosts.deny. When I delete this entry, it is logged back few
seconds after having save the file.

fail2ban is running on my remote server but it does not seem to
interfere with the /etc/hosts.deny file. I emptied the /var/log/
auth.log file as fail2ban parses the log to ban clients but it did not
manage to solve my issue and the IP address of my work computer still
gets logged in /etc/hosts.deny.

I could add my work computer IP address in /etc/hosts.allow, but I
cannot figure out why the IP address of my
work computer does not stop to get logged into /etc/hosts.deny right
after I removed the entry from the file.

I've even tried to totally empty the /etc/hosts.deny file. Few seconds
after I saved the file, all the previous entries I had removed were
logged back into /etc/hosts.deny.

Are there some services that monitor / update the file /etc/hosts.deny
periodically and that could cause to override my changes ?

Many thanks for your help
Antonin

4.hosts.deny and hosts.allow problem

Hi.  I'm having trouble setting up my hosts.allow and hosts.deny files.
 Basically I only want to be able to ssh in from one particular ip
address, e.g. xxx.xxx.xxx.xxx.

When my setup is:

# cat /etc/hosts.deny
ALL: ALL

# cat /etc/hosts.allow

I _cannot_ ssh in, as expected.



When it is:

# cat /etc/hosts.deny

# cat /etc/hosts.allow

I _can_ ssh in, as expected


But when it is:

# cat /etc/hosts.deny
ALL: ALL

# cat /etc/hosts.allow
sshd: xxx.xxx.xxx.xxx

I cannot ssh in....  I can't even get in when I do:

# cat /etc/hosts.allow
sshd: ALL

So it seems like hosts.deny works as I would anticipate, but
hosts.allow doesn't seem to be overuling hosts.deny.

Anyone have any clue?  This is Redhat 9

Thanks in advance....

Dan

5.help with hosts.allow -hosts.deny

Greatings,


I'm having a little trouble understanding how those files work. I have tried
looking at man hosts.allow, hosts.deny.

I saw that you needed to put       service:host

So I put in hosts.allow

sendmail:all
ftpd:all
httpd:all
sshd:all
vsftpd:all


in hosts.deny


all:all


So it denies all, except services put in allow, right?

There seems to be a flaw in my logic, maybe I am using the wrong names for
services? I'm running Red Hat 9. And am a bit new to the world of linux.

Thank you for any help possible,
Mikey

6. Xinetd & host.allow and host.deny

7. ssh, hosts.allow, hosts.deny, and dyndns names