A TCP Wrappers-aware daemon has matching rules in both /etc/hosts.allow and /etc/hosts.deny.
Which result is standard?
TCP Wrappers checks hosts.allow first. A match there permits the connection without checking hosts.deny; if no allow match exists, hosts.deny is checked.
Detailed explanation
Incorrect. hosts.allow is evaluated before hosts.deny.
Incorrect. hosts.allow is evaluated before hosts.deny.
Incorrect. An allow match takes precedence over a deny match.
Incorrect. An allow match takes precedence over a deny match.
Correct. An allow match permits the connection and hosts.deny is not consulted.
Correct. An allow match permits the connection and hosts.deny is not consulted.
Incorrect. The files are not merged into one last-rule-wins list.
Incorrect. The files are not merged into one last-rule-wins list.
Try it yourself
An example you can run in a temporary verification environment.
printf '%s
' '1 hosts.allow: match -> allow' '2 hosts.deny: match -> deny' '3 no match -> allow'Expected result
1 hosts.allow: match -> allow
2 hosts.deny: match -> deny
3 no match -> allowKey points
- Check allow first
- First matching file decides
- No match normally permits
Notes
- Environment: TCP Wrappers評価順の表示のみ
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.