The /etc/host.conf file

Securing and Optimizing Linux: RedHat Edition -A Hands on Guide
Prev | Chapter 5. General System Security | Next

# 5.10. The `/etc/host.conf` file

Linux uses a resolver library to obtain the IP address corresponding to a host name. The `/etc/host.conf` file specifies how names are resolved. The entries in the `etc/host.conf` file tell the resolver library what services to use, and in what order, to resolve names. Edit the `host.conf` file vi `/etc/host.conf` and add the following lines:

               # Lookup names via DNS first then fall back to /etc/hosts.
               order bind,hosts
               # We have machines with multiple IP addresses.
               multi on
               # Check for IP address spoofing.
               nospoof on

The `order` option indicates the order of services. The sample entry specifies that the resolver library should first consult the name server to resolve a name and then check the `/etc/hosts` file. It is recommended to set the resolver library to first check the name server, `bind` and then the hosts file (hosts) for better performance and security on all your servers. Of course you must have the DNS/BIND software installed or this configuration will not work.

The `multi` option determines whether a host in the `/etc/hosts` file can have multiple IP addresses i.e.multiple interface `ethN`. Hosts that have more than one IP address are said to be multiomed, because the presence of multiple IP addresses implies that host has several network interfaces. As an example, a Gateway Server will always have multiple IP address and must have this option set to `ON`.

The `nospoof` option indicates to take care of not permitting spoofing on this machine. IP-Spoofing is a security exploit that works by tricking computers in a trust relationship that you are someone that you really aren't. In this type of attack, a machine is set up to look like a legitimate server and then issue connections and other types of network activities to legitimate end systems, other servers or large data repository systems. This option must be set `ON` for all types of servers.

Prev | Home | Next
TCP_WRAPPERS | Up | The /etc/services file