From owner-freebsd-questions@FreeBSD.ORG Mon Jan 11 16:15:59 2010 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 052751065679 for ; Mon, 11 Jan 2010 16:15:59 +0000 (UTC) (envelope-from freebsd-questions-local@be-well.ilk.org) Received: from mail1.sea5.speakeasy.net (mail1.sea5.speakeasy.net [69.17.117.3]) by mx1.freebsd.org (Postfix) with ESMTP id D0AA18FC19 for ; Mon, 11 Jan 2010 16:15:58 +0000 (UTC) Received: (qmail 13394 invoked from network); 11 Jan 2010 16:15:58 -0000 Received: from dsl092-078-145.bos1.dsl.speakeasy.net (HELO be-well.ilk.org) ([66.92.78.145]) (envelope-sender ) by mail1.sea5.speakeasy.net (qmail-ldap-1.03) with SMTP for ; 11 Jan 2010 16:15:58 -0000 Received: by be-well.ilk.org (Postfix, from userid 1147) id 6FEA850829; Mon, 11 Jan 2010 11:15:56 -0500 (EST) From: Lowell Gilbert To: Anton Shterenlikht References: <20100111140105.GI61025@mech-cluster241.men.bris.ac.uk> <201001111408.43361.david@vizion2000.net> <20100111145346.GK61025@mech-cluster241.men.bris.ac.uk> Date: Mon, 11 Jan 2010 11:15:56 -0500 In-Reply-To: <20100111145346.GK61025@mech-cluster241.men.bris.ac.uk> (Anton Shterenlikht's message of "Mon, 11 Jan 2010 14:53:46 +0000") Message-ID: <44ocl0zkg3.fsf@be-well.ilk.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/23.1 (berkeley-unix) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: freebsd-questions@freebsd.org Subject: Re: denying spam hosts ssh access - good idea? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: freebsd-questions@freebsd.org List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Jan 2010 16:15:59 -0000 Anton Shterenlikht writes: > I'm very grateful for all advice, but I'm still unsure > why denying ssh access to a particular host via /etc/hosts.allow > is a bad idea. As far as I recall, the reason the warning was added to the manual was that it's fairly heavy on resources to implement that way (especially back before the wrapper support was added to sshd; running it out of inetd added quite a bit of lag). It is also liable to problems from the idiosyncratic configuration syntax. By and large, you'd be better off with a firewall, but hosts.allow will certainly work if you want to do that. -- Lowell Gilbert, embedded/networking software engineer, Boston area http://be-well.ilk.org/~lowell/