Red Hat LINUX 7.2 Reference Manual page 147

Section 9.2:Host-Based Access Control Lists
If your list of hostnames that may access a particular service is too long or is difficult to control within
host.allow or hosts.deny, you can also specify the full path to a file (such as /etc/tel-
net.hosts.deny). This file should contain different hostnames, host addresses, or patterns, sep-
arated by whitespace, that you want to allow or deny access to that service. This method also works
well to share access control lists between various services, as changes would only need to be made in
one file to affect each service.
The following wildcards may be used in the access control rules instead of using specific hosts or
groups of hosts:
• ALL — Matches every client with that particular service or even every service using access control.
The ALL wildcard can also apply to daemons.
• LOCAL — Matches any host that does not contain a "." character.
• KNOWN — Matches any host where the hostname and host address are known or where the user
is known.
• UNKNOWN — Matches any host where the hostname or host address are unknown or where the
user is unknown.
• PARANOID — Matches any host where the hostname does not match the host address.
The KNOWN, UNKNOWN, and PARANOID wildcards should be used very care-
fully, as a disruption in name resolution may make prevent legitimate users
from gaining access to a network service.
The access control language also contains a powerful operator, EXCEPT, which allows separate lists to
be combined within the same rule line. When EXCEPT is used between two lists, the first list applies
unless an entry from the second list matches an entity covered by the first list. EXCEPT can be used
with daemon or client lists. Consider the following hosts.allow example:
# all domain.com hosts are allowed to connect
# to all services except cracker.domain.com
ALL: .domain.com EXCEPT cracker.domain.com
# 123.123.123.* addresses can use all services except FTP
ALL EXCEPT in.ftpd: 123.123.123.
CAUTION
147