Prevent SSH password attacks using denyhosts package

When I saw this in my daily log report. I was like WTF! Script kiddies are having fun. Little bit of Googling and I installed the denyhosts package on Feodra Core 7. Here’s the step by step guide.

shell>yum install denyhosts
shell>/etc/init.d/denyhosts start

Most probably denyhosts is going to run on server restarts. However, make sure that’s the case by

shell>chkconfig denyhosts on

The denyhosts package watches the /var/log/secure log file at a fixed interval and then when it finds a match (like illegal login attempts, etc.) it adds an entry in the /etc/hosts.deny file. The /etc/hosts.deny file contains pairs of entries in network daemon, client ip (or hostname) format which looks like this:

daemon_name: X.Y.Z.W
 
After installing the denyhosts package, you can tweak the configuration by modifying the /etc/denyhosts.conf file. Here’s what I changed essentially


#Block the host after 3 failed attempts
#for non-existing logins
DENY_THRESHOLD_INVALID = 3
#Block the host after 5 failed
#attempts of existing logins
DENY_THRESHOLD_VALID = 5
#Block after 3 failed attempts for root login.
#Ideally, you should disable root login for ssh
DENY_THRESHOLD_ROOT = 3
#Good idea to capture the host name from IP
HOSTNAME_LOOKUP=YES
#I left this blank as we capture the
#reports via logwatch
ADMIN_EMAIL =

Here’s what my /etc/hosts.deny looked like after a few days

# DenyHosts: Sun Sep 7 06:00:08 2008 | sshd: 210.51.1.231
sshd: 210.51.1.231
# DenyHosts: Sun Sep 7 18:34:01 2008 | sshd: 117.36.50.66
sshd: 117.36.50.66
# DenyHosts: Mon Sep 8 05:05:04 2008 | sshd: 218.4.150.50
sshd: 218.4.150.50
# DenyHosts: Tue Sep 9 01:36:18 2008 | sshd: 12.174.168.124
sshd: 12.174.168.124

Don’t forget to restart denyhosts if you change the config file.

This entry was posted on Wednesday, September 10th, 2008 at 10:12 am and is filed under Linux. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.