Linux Networking Cookbook

7.15. Using DenyHosts to Foil SSH Attacks

Problem

The Internet is full of twits who have nothing better to do than to release automated SSH attacks on the world. You have taken all the sensible security precautions, and feel like your security measures are adequate, but your logfiles are overflowing with this junk. Isn't there some way to head these morons off at the pass?

Solution

Indeed, yes. The excellent DenyHosts utility will take care of you. DenyHosts parses your auth log, and writes entries to /etc/hosts.deny to block future intrusion attempts.

DenyHosts is a Python script, so you need Python 2.3 or newer. Find your Python version this way:

	$ python -V
	Python 2.4.2

DenyHosts can be installed with Aptitude or Yum. To install from sources, simply unpack the tarball in the directory where you want to store DenyHosts. This comes with denyhosts.cfg.dist, which is a model configuration file. Edit it, then save it as /etc/denyhosts.conf. (See Recipe 7.16 to learn how to configure a startup script.)

Next, create a whitelist in /etc/hosts.allow; in other words, add all the important hosts that you never want blocked.

This sample configuration is moderately stern. Make sure the filepaths are correct for your system:

 WORK_DIR = /var/denyhosts/data SECURE_LOG = /var/log/auth.log HOSTS_DENY = /etc/hosts.deny BLOCK_SERVICE = sshd DENY_THRESHOLD_INVALID = 3 DENY_THRESHOLD_VALID = 5 DENY_THRESHOLD_ROOT = 1 LOCK_FILE = /tmp/denyhosts.lock HOSTNAME_LOOKUP=NO SUSPICIOUS_LOGIN_REPORT_ALLOWED_HOSTS=YES ...