hosts_access.5 (2010 09)
h
hosts_access(5) hosts_access(5)
NAME
hosts_access - format of host access control files
DESCRIPTION
The access control facility for internet services uses access control files to grant or deny access to its ser-
vices. These files are defined using a simple access control language based on client (host name/address,
user name) and server (process name, hostname/address) patterns. See the EXAMPLES section for a
quick introduction.
An extended version of the access control language is described in hosts_options(5).
Access Control Files
daemon is the process name of a network daemon process, and
client is the name and/or address of a
host requesting service. Network daemon process names are specified in the
inetd configuration file
(
/etc/inetd.conf
). The access control software searches the contents of two files:
/etc/hosts.allow
and /etc/hosts.deny
.
The files are searched in the following order. The search stops with the first match:
•
/etc/hosts.allow
file is checked first for a matching (daemon, client) pair. If one is found,
access is granted and the search stops.
•
/etc/hosts.deny file is checked if no match was found in the
/etc/hosts.allow file and
access will be denied if a (daemon, client) pair match is found.
• If no (daemon, client) match was found in either access control file, access will be granted.
A non-existing access control file is treated as if it were an empty file. Thus, access control can be turned
off by providing no access control files.
Access Control Rules
Each access control file consists of zero or more lines of text. These lines are processed in order of
appearance. The search terminates when a match is found. The following points describe the format of
the access control file:
• A newline character is ignored when it is preceded by a backslash ("\"). This permits you to
break up long lines so that they are easier to edit.
• Blank lines or lines that begin with a # character are ignored. This permits you to insert com-
ments and whitespace so that the tables are easier to read.
• All other lines should be in the following format. Contents in between
[] square brackets are
optional:
daemon_list
: client_list [ : shell_command
]
daemon_list is a list of one or more daemon process names (argv[0] values ) or wildcards
(see below).
client_list is a list of one or more host names, host addresses, patterns or wildcards (see
below) that will be matched against the client host name or address. NOTE: An
IPv6 address should be enclosed in square brackets
[] without any whitespace.
The more complex forms
daemon@host and user@host are explained in the Server Endpoint Patterns
and Client Username Lookups sections respectively.
List elements must be separated by blanks and/or commas.
With the exception of NIS (YP) netgroup lookups, all access control checks are case-insensitive.
Patterns
The access control language implements the following patterns:
• A string that begins with a dot (
.) character specifies to match the components after the dot. A
host name is matched if the last components of its name match the specified pattern. For exam-
ple, the pattern .xyz.com matches the host name abc.def.xyz.com.
• A string that ends with a dot (
.) character specifies to match the components before the dot. A
host address is matched if its first numeric fields match the given string. For example, the pat-
tern 192.3. matches the address of (almost) every host (192.3.x.x) on the 192.3 network.
HP-UX 11i Version 3: September 2010 − 1 − Hewlett-Packard Company 1