From 02de66e97bb1f6430dd152407ed4da89b0459a42 Mon Sep 17 00:00:00 2001
From: Simon Clark <simon.richard.clark@gmail.com>
Date: Apr 27 2018 10:24:55 +0000
Subject: Add #85 'Deprecate TCP wrappers'


---

diff --git a/en-US/sysadmin/Security.adoc b/en-US/sysadmin/Security.adoc
index a0874eb..c5f4ebc 100644
--- a/en-US/sysadmin/Security.adoc
+++ b/en-US/sysadmin/Security.adoc
@@ -30,6 +30,12 @@ certutil -d sql:</path/to/database> -N -f </path/to/database/password/file> \
 ----
 
 
+== Deprecate TCP wrappers
+
+Fedora 28 https://fedoraproject.org/wiki/Changes/Deprecate_TCP_wrappers[removes support] for `tcp_wrappers` (aka `/etc/hosts.deny` access files) by default from all the network daemons and tools.
+The preferred replacements are software firewalld, nftables rules or software specific access rules for more complex filtering.
+If your system security depends on `tcp_wrappers` rules, convert them to firewall rules, or set up `tcpd` to do the same job for you.
+
 == OpenLDAP switches from NSS to OpenSSL
 
 With this update, the OpenLDAP distribution in Fedora changed from using the *NSS* (or *MozNSS*) library to the *OpenSSL* library for providing cryptographic functions. The switch promises better support from OpenLDAP upstream, which had ceased maintaining the NSS support layer.