Use denyhosts to prevent SSH brute force under Linux

1.DenyHosts Introduction

DenyHosts is a program written in the Python language that parses the sshd log file (/var/log/secure) and logs the IP to the/etc/hosts.deny file when a duplicate attack is found, thus achieving the function of the auto-screen IP.

DenyHosts official website is: http://denyhosts.sourceforge.net

2. Installing denyhosts

" downloads.sourceforge.net/project/denyhosts/denyhosts/2.6/denyhosts-2.6.tar.gz "  -xzf denyhosts-2.6. tar.gz cd denyhosts-2.6python setup.py install

DenyHosts install to/usr/share/denyhosts directory by default

3. Configuration

cd/usr/share/denyhosts/CP denyhosts.cfg-Dist Denyhosts.cfgvim denyhosts.cfg

Modify the following:

Purge_deny =1h #过多久后清除已阻止IPHOSTS_DENY=/etc/hosts.deny #将阻止IP写入到hosts. Denyblock_service=sshd #阻止服务名DENY_THRESHOLD_INVALID=1#允许无效用户登录失败的次数DENY_THRESHOLD_VALID=Ten#允许普通用户登录失败的次数DENY_THRESHOLD_ROOT=5#允许root登录失败的次数WORK_DIR=/usr/share/denyhosts/Data #将deny的host或ip纪录到Work_dir中DENY_THRESHOLD_RESTRICTED=1#设定 deny host writes to this folder Lock_file= /var/Lock/subsys/DenyHosts #将DenyHOts启动的pid纪录到LOCK_FILE中 ensures that the service starts correctly and prevents multiple services from starting at the same time. Hostname_lookup=NO #是否做域名反解ADMIN_EMAIL=#设置管理员邮件地址DAEMON_LOG= /var/log/denyhosts #自己的日志文件DAEMON_PURGE= 1h #该项与PURGE_DENY set to the same, it is time to clear the Hosts.deniedssh user

4. Set the startup script

Enable DenyHosts to start automatically after each restart:

CP daemon-control-dist daemon--s/usr/share/denyhosts/daemon-control/etc/init.d/--add Denyhostschkconfig denyhosts onservice denyhosts start

5. View shielded IP

[Email protected] ~]# cat/etc/hosts.deny## Hosts.deny This file contains access rules which is used to# deny connections to network servi Ces that either use# the Tcp_wrappers library or that has been# started through a tcp_wrappers-enabled xinetd.## the rulesinch  ThisFile can also beSetUpinch#        /etc/hosts.allow with a'Deny'option instead.## see'Mans 5 Hosts_options'and'Mans 5 Hosts_access'#         forinformation on rule syntax.# see'Mans TCPD'  forinformation on tcp_wrappers## Denyhosts:mon Mar7  -:Geneva:xx  .| Sshd:123.30.135.177sshd:123.30.135.177# Denyhosts:mon Mar7  -: -: to  .| Sshd:125.88.177.95sshd:125.88.177.95

Use denyhosts to prevent SSH brute force under Linux