in hosts.deny (i forget if it's the default, or if i added
it myself) i have

ALL:ALL[EOF]

so the line ends with EOF not end of line.  tcpd doesn't
like this and IGNORES it.  in the logs i get:

warning: /etc/hosts.deny, line 9: missing newline or line
too long

but then tcpd allows the connection through since it doesn't
think ALL:ALL is a good rule that should be applied.

tcpd should be fixed so that it accepts end of file as end
of a line.