Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to prevent code from making http connections to other, specific hosts. My understanding is this can be done in /etc/hosts.deny. What would that look like?

share|improve this question

migrated from stackoverflow.com Feb 28 '11 at 21:12

This question came from our site for professional and enthusiast programmers.

5 Answers 5

You could map the hostnames to localhost in /etc/hosts (its easier to setup than hosts.deny, but lacks granular control).

Example entry in hosts file:

google.com    127.0.0.1
someotherdomain.com    127.0.0.1

Oh btw, this question is better suited for serverfault.com.

share|improve this answer
    
This is what I tried initially but it gave me unexpected results. For one, as another poster mentioned, if there is a webserver listening on localhost, it would respond to the request. Also, some programs cache hostname lookups indefinitely. If I'm interested in only temporarily disabling connections, then I would have to restart that program to refresh its DNS cache. –  Nate Reed Feb 28 '11 at 21:32
    
@Nate Try setting it an internal address that isn't in use on your network. Eg. google.com 192.168.20.250 –  John2496 Feb 28 '11 at 22:40

The /etc/hosts/ approach is a poor one since on whatever address you redirect the "forbidden host" to, another web-server might listen.

If you have write access to /etc/hosts, you're generally root and also in charge of setting up your firewall. This is where you should set up rules concerning outgoing traffic.

share|improve this answer

The linux kernel has firewall capabilities. these will probably give you the best results. It's not clear from you question if you want to block all http connection from your machine to the specific hosts, or only a specific program - but if needed you can also filter traffic by originating application or user.

I usually use FireHOL which is a convenient wrapper around the basic firewall configuration commands.

share|improve this answer

A good breakdown of the host files: http://linux.about.com/od/commands/l/blcmdl5_hostsde.htm

share|improve this answer

No, hosts.deny will not do it. Nor will hacking /etc/hosts make any difference (it may break the resolver library, but not prevent an application making outbound connections if it does not use the standard resolver, or finds addresses in some other way).

Using a firewall is really the most obvious way. For locally-generated traffic, iptables is able to block outbound packets by user ID, group ID or process ID, which means you can restrict it to specific processes. Probably the easiest way is to do it by user ID, and run it under some restricted user.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.