#denyhosts

How to install and configure denyhosts on Ubuntu 18.04 LTS

Intrusion prevention security tool

 According to the developers of denyhosts script, the script is intended to help thwart SSH server attacks on Linux systems. These attacks are sometimes referred to as dictionary based attacks or brute force attacks.

A short audit to your ssh log (/var/log/auth.log on ubuntu) will give you an idea of the number of hackers trying to gain access to your…

Resolved: Denyhosts vs fail2ban vs iptables- best way to prevent brute force logons? #computers #programming #development

Denyhosts vs fail2ban vs iptables- best way to prevent brute force logons?

I’m setting up a LAMP server and need to prevent SSH/FTP/etc. brute-force logon attempts from succeeding. I’ve seen many recommendations for both denyhosts and fail2ban, but few comparisons of the two. I also read that an IPTables rule can fill the same function.

Why would I choose one of these methods over another? How…

Answer: Denyhosts vs fail2ban vs iptables- best way to prevent brute force logons? #dev #computers #answer

Denyhosts vs fail2ban vs iptables- best way to prevent brute force logons?

I’m setting up a LAMP server and need to prevent SSH/FTP/etc. brute-force logon attempts from succeeding. I’ve seen many recommendations for both denyhosts and fail2ban, but few comparisons of the two. I also read that an IPTables rule can fill the same function.

Why would I choose one of these methods over another? How…

自分管理のサーバにブルートフォース攻撃対策としてdenyhostsを導入。 ちなみにOSはCentOS5.5。

denyhostsをインスコ

sudo yum --enablerepo=remi install denyhosts

remi以外のリポジトリにもあると思う。

設定ファイルをいじる

sudo emacs /etc/denyhosts.conf

以下いじった箇所。

https://gist.github.com/dex1t/5797730.js?file=1st

こんな感じで。 検出があったときにメール送信するオプションもあるんだけど、 結構な量がくるみたい?なので、設定しませんでした。

対象外リスト編集

sudo emacs /etc/hosts.allow

denyhostsの拒否対象外のIPアドレスを設定。 単純なパスワード間違いがブルートフォース攻撃と認識されないように、予めIPアドレスを書いとく。 以下のように追記

https://gist.github.com/dex1t/5797730.js?file=2nd

起動

https://gist.github.com/dex1t/5797730.js?file=3rd

これで導入完了。 ブロックされたIPアドレスが，/etc/hosts.denyに追記されるはず。

Install the YUM priorities and denyhosts:

yum install yum-priorities denyhosts

Add denyhosts to startup and then start it up:

# chkconfig denyhosts on # service denyhosts start

J'avais une erreur bizarre avec ssh... Je pouvait me connecter avec mon login / password (celui de root en fait) mais dès que j'enregistrait ma clé id_rsa.pub dans le fichier authorized_key du serveur je me retrouvait systématiquement ajouté dans /etc/hosts.deny et du coup je récupérait l'erreur suivante :

ssh_exchange_identification: Connection closed by remote host

Après quelques recherche j'ai découvert que c'était la faute de denyhost et après avoir lu son fichier de config puis être tombé sur ce blog, j'ai ajouter l'ip de ma machine dans le fichier /var/lib/denyhosts/allowed-hosts que j'ai créé pour l'occasion. Et tout marche :)