Red Hat ENTERPRISE LINUX 5 - DEPLOYMENT Deployment Manual page 682

Chapter 43. Securing Your Network
• PARANOID — Matches any host where the hostname does not match the host address.
Caution
The KNOWN, UNKNOWN, and PARANOID wildcards should be used with care, because they
rely on functioning DNS server for correct operation. Any disruption to name resolution
may prevent legitimate users from gaining access to a service.
43.5.2.1.2. Patterns
Patterns can be used in the client field of access rules to more precisely specify groups of client hosts.
The following is a list of common patterns for entries in the client field:
• Hostname beginning with a period (.) — Placing a period at the beginning of a hostname matches
all hosts sharing the listed components of the name. The following example applies to any host
within the example.com domain:
ALL : .example.com
• IP address ending with a period (.) — Placing a period at the end of an IP address matches all hosts
sharing the initial numeric groups of an IP address. The following example applies to any host within
the 192.168.x.x network:
ALL : 192.168.
• IP address/netmask pair — Netmask expressions can also be used as a pattern to control access to
a particular group of IP addresses. The following example applies to any host with an address range
of 192.168.0.0 through 192.168.1.255:
ALL : 192.168.0.0/255.255.254.0
Important
When working in the IPv4 address space, the address/prefix length (prefixlen) pair
declarations (CIDR notation) are not supported. Only IPv6 rules can use this format.
• [IPv6 address]/prefixlen pair — [net]/prefixlen pairs can also be used as a pattern to control access
to a particular group of IPv6 addresses. The following example would apply to any host with an
address range of 3ffe:505:2:1:: through 3ffe:505:2:1:ffff:ffff:ffff:ffff:
ALL : [3ffe:505:2:1::]/64
• The asterisk (*) — Asterisks can be used to match entire groups of hostnames or IP addresses, as
long as they are not mixed in a client list containing other types of patterns. The following example
would apply to any host within the example.com domain:
656