> Turns out it wasn't ssh. It was libwrap. It seems that the treatment of
> hosts.deny has changed.
> I was using just a hosts.deny file with lines like:
> rpcbind: ALL EXCEPT .rmkhome.com, localhost
> That doesn't work anymore. A hosts.allow and a hosts.deny file are now
> required.

I think that hosts.allow is sufficient:  I have

	rexecd: LOCAL, .funhouse.com: ALLOW
	rexecd: ALL: DENY
	telnetd: LOCAL, .funhouse.com: ALLOW
	telnetd: ALL: DENY

in hosts.allow and no hosts.deny, and it appears to do what I want.