TCP Wrapper (hosts.allow and hosts.deny) Command Options in Linux

Updated: 11 October 2026 · Applies to: AlmaLinux 9 / Rocky Linux 9, Ubuntu 24.04 and Debian 12

TCP Wrappers let services check /etc/hosts.allow and /etc/hosts.deny before accepting a connection. They are obsolete: RHEL 8 and later (and so AlmaLinux 9 / Rocky Linux 9) removed them completely, so these files have no effect there.

What to use instead

• The firewall: allow a port only from certain addresses (see "How to Enable Port for a Specific IP Address in Firewalld").
• SSH settings: limit who may log in with AllowUsers or AllowGroups in /etc/ssh/sshd_config, or use a Match Address block, then systemctl reload sshd.
• Service settings: many services have their own access lists, for example bind-address for MariaDB or Require ip in Apache.

Ubuntu and Debian

On Ubuntu 24.04 and Debian 12 the OpenSSH server still reads the files. The format is service: client-list:

# /etc/hosts.allow
sshd: 203.0.113.10 198.51.100.0/24

# /etc/hosts.deny
sshd: ALL

Note: Rules take effect at once. Add your own IP to hosts.allow before denying everything, or you will lock yourself out. A firewall rule is still the more reliable option.