I was tasked to write a security policy to apply to any ubuntu server we deploy at a client's site. Knowing how some of the corporate are restrictive on what resource is available to what box on their network especially banks i have been wondering.
Let me explain,if I understand well, denyhost itself connects to a database( or databases) to either report or fetch all "bad" IPs.
first question is whether that database is local or stored somewhere on a host on the internet.
second question is related to the first one. If that database is online, how secure it is from being hacked itself(an attacker could rather tamper with the database removing its new IP)
I will really appreciate if anyone can shed some light on this
/etc/hosts.deny
to block access from specific machines. That file is owned byroot
so you needsudo
privileges to make changes. Higher level blocking would be done at a firewall or a Group Policy on an AD Domain.