The /etc/hosts.deny file specifies which IP addresses are not permitted to connect to the host. It is intended to be used in conjunction with the /etc/hosts.allow file.
Rationale
The /etc/hosts.deny file serves as a failsafe so that any host not specified in /etc/hosts.allow is denied access to the server.
Audit Procedure
Using Command Line
Verify that /etc/hosts.deny exists and is configured to deny all hosts not explicitly listed in /etc/hosts.allow:
grep "ALL: ALL" /etc/hosts.deny
Expected Result
ALL: ALL
Remediation
Using Command Line
Create /etc/hosts.deny:
echo "ALL: ALL" >> /etc/hosts.deny
Default Value
The /etc/hosts.deny file may or may not exist by default and may be empty.
References
CIS Ubuntu 12.04 LTS Server Benchmark v1.1.0
Profile
Level 1 - Not Scored
1---2name: cis-ubuntu1204-v110-7-4-43description: Create /etc/hosts.deny4---56# 7.4.4 Create /etc/hosts.deny (Not Scored)78## Profile Applicability910- Level 11112## Description1314The `/etc/hosts.deny` file specifies which IP addresses are **not** permitted to connect to the host. It is intended to be used in conjunction with the `/etc/hosts.allow` file.1516## Rationale1718The `/etc/hosts.deny` file serves as a failsafe so that any host not specified in `/etc/hosts.allow` is denied access to the server.1920## Audit Procedure2122### Using Command Line2324Verify that `/etc/hosts.deny` exists and is configured to deny all hosts not explicitly listed in `/etc/hosts.allow`:2526```bash27grep "ALL: ALL" /etc/hosts.deny28```2930## Expected Result3132```33ALL: ALL34```3536## Remediation3738### Using Command Line3940Create `/etc/hosts.deny`:4142```bash43echo "ALL: ALL" >> /etc/hosts.deny44```4546## Default Value4748The `/etc/hosts.deny` file may or may not exist by default and may be empty.4950## References5152- CIS Ubuntu 12.04 LTS Server Benchmark v1.1.05354## Profile5556Level 1 - Not Scored
Run npx skillmds@latest add cyberstrikeus/cis-ubuntu1204-v110-7-4-4 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Create /etc/hosts.deny It is listed under Coding & Dev Tools on SkillMD.
SkillMD's automated safety review verdict for this skill is PASS. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
cyberstrikeus (@cyberstrikeus) published this skill. Their other Agent Skills are listed on their SkillMD profile.
cyberstrikeus