contact :: legal :: webstats  also on this site: - select - home tech writings green business studies conspiracy popular pages welcome  also in this section:  tech index  most popular pages  search: Like this site? Your donation is welcome!

denyhosts (docs: FAQ) can be used to stop many kinds of brute-force attacks. If you're not using key-based authentication for SSH, you'll probably want to install denyhosts, as it gives an extra layer of security, and may allow some restrictions to be relaxed (eg. restricting login from certain IP addresses only). In addition, denyhosts can be used to simultaneously block attacks on protocols other than SSH. denyhost's drawbacks include its Python dependency, and also its use of TCP wrappers. However this use of TCP wrappers means that it does not need a firewall in order to operate.

NOTE: if you do not plan on exposing any ports to the public internet, you do not need to install denyhosts.

How to install:

1. cd /usr/ports/security/denyhosts
2. make install clean
3. if prompted for Python configuration, make changes as necessary and continue
4. vi /etc/rc.conf
5. add these lines (if the syslogd_flags setting already exists, ensure it includes the -c switch):

   denyhosts_enable="YES"
   syslogd_flags="-c"
   

6. save the changes and exit the editor
7. vi /etc/hosts.allow
8. comment out this line:

   ALL : ALL : allow
   

9. add these lines just before the sendmail settings:

   # denyhosts
   sshd : /etc/hosts.deniedssh : deny
   sshd : ALL : allow
   

10. save the changes and exit the editor
11. vi /usr/local/etc/denyhosts.conf
12. uncomment this line:

    BLOCK_SERVICE  = sshd
    

13. save the changes and exit the editor
14. touch /etc/hosts.deniedssh
15. /etc/rc.d/syslogd restart
16. /usr/local/etc/rc.d/denyhosts start

Notes:

• the file /etc/hosts.deniedssh will be created by touch, if it does not exist
• configuration options can be found in /usr/local/etc/denyhosts.conf
• check that denyhosts is running with ps -ax|grep denyhosts
• logfile is /var/log/denyhosts
• denied hosts will be listed in /etc/hosts.deniedssh
• failed connection attempts will be logged to /var/log/auth.log with a "refused connect" message like this: "You are not welcome to use [service] from [IP]."
• once denyhosts is running, if another daemon (say, mysqld) reports "refused connect" in /var/log/auth.log, add a line to /etc/hosts.allow to permit traffic to that daemon. In the case of mysql, which will also report "mysqld[483]: error: /etc/hosts.allow, line xx: twist option in resident process" in /var/log/auth.log, open /etc/hosts.allow and add these lines after the SSH lines added above:

  # mysql
  mysqld : ALL : allow
  

  All hosts will be then allowed to connect to mysqld. Ensure to remove any mistakenly blocked hosts from /etc/hosts.deniedssh (denyhosts will probably have added any clients that attempted to use mysql while it was blocked to the /etc/hosts.deniedssh file). A restart of denyhosts, mysqld or anything else is NOT required.

  This example permits a single IP access to SWAT (Samba's configuration tool):

  # SWAT
  swat : 192.168.0.1 : allow
  swat : ALL : deny
  

related articles:  my FreeBSD diary  FreeBSD and ATA disks  adding a disk  upgrading a disk  FreeBSD backups  backing up to a remote volume  Samba as a file server (low security)  Samba as a file server (high security)  Samba as a Primary Domain Controller  Samba as a member server  Samba as a print server (with CUPS)  troubleshooting Samba  troubleshooting printing with CUPS  configuring sendmail  installing phpMyAdmin  dealing with mail for root  working with cron  installing and using GPG  automated PHP scripting  special-purpose users  upgrading to key-based authentication  distributed data warehousing  doing a minor version upgrade  upgrading from 6.1 to 6.4  upgrading 6.2 and below  installing and using Webmin  installing and using denyhosts  filesystem access controls  unix basics