Centos uses denyhosts to prevent ssh attacks

Authentication Failures:
Root (218.247.185.218): 575 Time (s)
Unknown (218.247.185.218): 224 Time (s)
Unknown (218.247.185.222): 6 Time (s)
Unknown (202.101.72.35): 5 Time (s)
Unknown (202.101.72.36): 5 Time (s)
Unknown (202.101.72.37): 5 Time (s)
Unknown (202.101.72.44): 5 Time (s)
Unknown (202.101.72.32): 4 Time (s)
Unknown (202.101.72.40): 4 Time (s)
Unknown (202.101.72.43): 4 Time (s)
Unknown (202.101.72.45): 4 Time (s)
Unknown (202.101.72.47): 4 Time (s)
Unknown (202.101.72.50): 4 Time (s)
Unknown (202.101.72.53): 4 Time (s)
Unknown (202.101.72.56): 4 Time (s)
Unknown (202.101.72.57): 4 Time (s)
Unknown (202.101.72.60): 4 Time (s)
Unknown (202.101.72.62): 4 Time (s)
Root (218.247.185.222): 3 Time (s)
Unknown (202.101.72.33): 3 Time (s)
Unknown (202.101.72.34): 3 Time (s)
Unknown (202.101.72.38): 3 Time (s)
Unknown (202.101.72.39): 3 Time (s)
Unknown (202.101.72.41): 3 Time (s)
Unknown (202.101.72.48): 3 Time (s)
Unknown (202.101.72.51): 3 Time (s)
Unknown (202.101.72.52): 3 Time (s)
Unknown (202.101.72.54): 3 Time (s)
Unknown (202.101.72.55): 3 Time (s)
Unknown (202.101.72.58): 3 Time (s)
Unknown (202.101.72.61): 3 Time (s)
Unknown (202.101.72.63): 3 Time (s)
Ftp (202.101.72.34): 2 Time (s)
Mail (218.247.185.218): 2 Time (s)
Mysql (218.247.185.218): 2 Time (s)
News (218.247.185.218): 2 Time (s)
Root (192.168.123.69): 2 Time (s)
Unknown (202.101.72.42): 2 Time (s)
Unknown (202.101.72.46): 2 Time (s)
Unknown (202.101.72.49): 2 Time (s)
Unknown (202.101.72.59): 2 Time (s)
Adm (202.101.72.34): 1 Time (s)
Adm (202.101.72.42): 1 Time (s)
Adm (202.101.72.46): 1 Time (s)
Adm (202.101.72.49): 1 Time (s)
Adm (202.101.72.51): 1 Time (s)
Adm (202.101.72.58): 1 Time (s)
Adm (202.101.72.59): 1 Time (s)
Adm (202.101.72.61): 1 Time (s)
Adm (218.247.185.218): 1 Time (s)
Apache (218.247.185.218): 1 Time (s)
Bin (218.247.185.218): 1 Time (s)
Ftp (202.101.72.33): 1 Time (s)
Ftp (202.101.72.39): 1 Time (s)
Ftp (202.101.72.46): 1 Time (s)
Ftp (202.101.72.58): 1 Time (s)
Ftp (202.101.72.60): 1 Time (s)
Ftp (218.247.185.218): 1 Time (s)
Games (218.247.185.218): 1 Time (s)
Lp (218.247.185.218): 1 Time (s)
Mysql (202.101.72.38): 1 Time (s)
Mysql (202.101.72.39): 1 Time (s)
Mysql (202.101.72.42): 1 Time (s)
Mysql (202.101.72.49): 1 Time (s)
Mysql (202.101.72.51): 1 Time (s)
Mysql (202.101.72.59): 1 Time (s)
Mysql (202.101.72.61): 1 Time (s)
Nobody (218.247.185.218): 1 Time (s)
Operator (218.247.185.218): 1 Time (s)
Postgres (202.101.72.33): 1 Time (s)
Postgres (202.101.72.48): 1 Time (s)
Postgres (202.101.72.49): 1 Time (s)
Postgres (202.101.72.52): 1 Time (s)
Postgres (202.101.72.53): 1 Time (s)
Postgres (202.101.72.54): 1 Time (s)
Rpm (218.247.185.218): 1 Time (s)
Squid (218.247.185.218): 1 Time (s)
Sshd (218.247.185.218): 1 Time (s)
Invalid Users:
Unknown Account: 341 Time (s)

It's okay today in Hangzhou.

First install a package so that yum can directly fetch the package on The dag:

Wget http://ftp.belnet.be/packages/dr... 2.2.el4.rf.i386.rpm

Rpm-ivh rpmforge-release-0.2-2.2.el4.rf.i386.rpm

In this way, you can directly use yum to install denyhosts:

Yum install denyhosts

Perform the following settings:

Cp/usr/share/doc/denyhosts-2.2/daemon-control-dist/etc/init. d/denyhosts

Cp/usr/share/doc/denyhosts-2.2/denyhosts. cfg-dist/etc/denyhosts. cfg

Vi/etc/init. d/denyhosts

Change the value of DENYHOSTS_CFG to "/etc/denyhosts. cfg"

Add to services:

Chkconfig -- add denyhosts
Chkconfig -- level 2345 denyhosts on

Modify the configuration file:

Vi/etc/denyhosts. cfg

SECURE_LOG =/var/log/secure
# Ssh log file, which is determined based on this file.

HOSTS_DENY =/etc/hosts. deny
# Control user login files

PURGE_DENY = 5 m
# How long will it take to clear prohibited

BLOCK_SERVICE = sshd
# Forbidden service name

DENY_THRESHOLD_INVALID = 1
# Number of failed invalid Users Allowed

DENY_THRESHOLD_VALID = 10
# Number of failed login attempts allowed for common users

DENY_THRESHOLD_ROOT = 5
# Number of root Login failures allowed

HOSTNAME_LOOKUP = NO
# Whether domain name resolution is performed

ADMIN_EMAIL = hui@ffccc.com
# Administrator email address, which will send an email to the Administrator

DAEMON_LOG =/var/log/denyhosts
# Your own log files

Then you can start it:

Service denyhost start

Check whether any prohibited IP address exists in/etc/hosts. deny.