A TCP Wrappers-aware daemon has matching rules in both /etc/hosts.allow and /etc/hosts.deny.
Which result is standard?
TCP Wrappers checks hosts.allow first. A match there permits the connection without checking hosts.deny; if no allow match exists, hosts.deny is checked.
Detailed explanation
Incorrect. hosts.allow is evaluated before hosts.deny.
Incorrect. An allow match takes precedence over a deny match.
Correct. An allow match permits the connection and hosts.deny is not consulted.
Incorrect. The files are not merged into one last-rule-wins list.
Try it yourself
An example you can run in a temporary verification environment.
printf '%s
' '1 hosts.allow: match -> allow' '2 hosts.deny: match -> deny' '3 no match -> allow'Expected result
1 hosts.allow: match -> allow
2 hosts.deny: match -> deny
3 no match -> allowKey points
- Check allow first
- First matching file decides
- No match normally permits
Notes
- Environment: TCP Wrappers評価順の表示のみ
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.