Don't you want your ssh to be cracked? Come on!

We have received complaints from elders recently ~
Website access is slow ~~ What did you do !!!
 
Of course, I can't tell them how they even do it .....
 
I visited it myself. Although the server is an old machine, it is time to beat my ass to this level...
 
You can only log on to the server using ssh to check machine performance ~
 
Why? There are new discoveries !!!
 
# Tail-n 500/var/log/message
By browsing the system logs, we found that many bad ip addresses are attacking me...
 
 

 
These ip addresses all hope to crack the server's ssh password through brute force attacks to control the server...
 
Sinister! This world ~
 
Although the server has not been attacked, many system and network resources are consumed! Alas, why is it difficult to make money ~
 
There is obviously no way to unseal an ip address in the firewall, so I am looking for a software proxy, which is a very famous hacking tool DenyHosts.
As the name implies, DenyHosts is used to create an ip address. DenyHosts analyzes the sshd log file (/var/log/secure ), if the same ip address attempts to crack the ip address multiple times in a row (you can set the number of connections), the ip address is automatically written to/etc/hosts. deny file to block the IP address.
 
The Empire counterattack is now underway!
 
 
1. Obtain DenyHosts
The software is free of charge and can be obtained directly from the official website.
However, pay attention to the following when downloading the version:
The installation and running of DenyHosts depend on python. If python is installed on the machine, check the python version to download the rpm package of the corresponding version.
 
Python is installed on my machine. The version is 2.3.
 
 
If the machine does not have Python installed, download tar.gz with Python program directly to install python.
 
 
2. Install and start DenyHosts
# Tar xzvf DenyHosts-2.6.tar.gz
Unzip the installation package to any location
 
# Cd DenyHosts-2.6
Enter the extract directory
 
# Python setup. py install
Run the installation program and install DenyHosts to the default location.
 
:
 
 
DenyHosts is installed in the/usr/share/denyhosts directory by default.
Modify the DenyHosts configuration file to start the program ~
 
# Cd/usr/share/denyhosts
Enter the main configuration directory of denyhosts
 
# Cp denyhosts. cfg-dist denyhosts. cfg
# Cp daemon-control-dist daemon-control
Copy the default configuration file and program execution File
 
# Chmod 770 daemon-control
Modify the operation permission of the program execution File
 
#./Daemon-control start
Start denyhosts
 
Denyhosts started properly
 

 
If you want denyhosts to automatically start with the system each time, you can perform the following operations ~
 
# Cd/etc/init. d
 
# Ln-s/usr/share/denyhosts/daemon-control denyhosts
Create a new link symbol in the/etc/init. d/directory to the startup execution file of daemon-control.
 
# Chkconfig -- add denyhosts
# Chkconfig -- level 2345 denyhosts on
 
OK!
 
 
3. Configure DenyHosts
 
Denyhosts. cfg is the configuration file of denyhosts!
The following describes some common configuration items.
 
SECURE_LOG =/var/log/secure // sshd log file. denyhosts shields ip addresses by analyzing this file. The log files and locations of sshd vary with systems, the configuration files are listed and can be modified as needed
 
HOSTS_DENY =/etc/hosts. deny // control the user logon file. The blocked ip address will be written to this file.
 
PURGE_DENY = 20 m // you can set the time after which the blocked ip address is removed. The unit is minute. If this parameter is left blank, the ip address is disabled ~ Hey!
 
The PURGE_DENY parameter also has the following units for reference:
 
# 'M' = minutes
# 'H' = hours
# 'D' = days
# 'W' = weeks
# 'Y' = years
 
BLOCK_SERVICE = sshd // forbidden service name. In addition to sshd, denyhosts can also be used for other services, such as smtp.
 
DENY_THRESHOLD_INVALID = 5 // The number of Logon failures allowed for invalid users. If the number of failed logon attempts exceeds the configured value, the user must be cut ~~
 
DENY_THRESHOLD_VALID = 3 // allows normal users to log on to the failed times, exceeding the set cut ~~
 
DENY_THRESHOLD_ROOT = 1 // The number of Logon failures allowed by the root user exceeds the set cut ~~
 
DENY_THRESHOLD_RESTRICTED = 1 // The number of Logon failures allowed by the restricted user. If the limit is exceeded, the user must be cut ~~
 
HOSTNAME_LOOKUP = YES // do you want to perform domain name anti-resolution? leave it blank to indicate no
 
DAEMON_LOG =/var/log/denyhosts // location of the denyhosts log File
 
 
You can set other settings by default ~ 4. Check that DenyHosts works normally. Check whether the denyhosts is very simple. Check whether the hosts. deny file has a blocked IP address. # Vi/etc/hosts. deny started to catch turtles ~~ Haha ~ It's amazing! Success !!!

From lancent's BLOG