DenyHosts is a Python script that is “intended to be run by Linux system administrators to help thwart ssh server attacks.” Basically it takes a look at your logs, scanning for hosts that have attempted to connect to your ssh daemon. It then automatically adds any hosts that appear to be attempting to hack into your system to /etc/hosts.deny, permanantly blocking them.

It is made to be run from cron or as a daemon, so it continually checks for offending hosts and automatically adds them to the blacklist. Just let it run in the background and it does the work. It’s really a pretty slick idea.

So I loaded it on my Gentoo box to try it out…

First up, emerge the script:

# echo "app-admin/denyhosts ~x86"> package.keywords
# emerge denyhosts

The ebuild gave me a configuration file at /etc/denyhosts.conf. Looked pretty good to me so it was time to test it out:

# denyhosts --version DenyHosts version: 1.1.2

Installed ok, so then I ran it with the default settings:

# denyhosts --verbose -c /etc/denyhosts.conf Processing log file (/var/log/messages) from offset (0) Added the following hosts to /etc/hosts.deny: 192.168.2.10 (unknown) 192.168.1.101 (unknown) 192.168.1.102 (unknown) 192.168.1.5 (callisto) callisto 198.203.136.130 (unknown)

Heh, well that doesn’t look good. It flagged most of the boxen on my LAN’s two subnets:

# cat /etc/hosts.deny sshd: 192.168.2.10 sshd: 192.168.1.101 sshd: 192.168.1.102 sshd: 192.168.1.5 sshd: callisto sshd: 198.213.146.130

It did block one IP that I didn’t recognize, and one other IP that belongs to a Matt (not shown). The rest of the IPs belong to my trusted computers, including my main desktop at 192.168.1.5. Easy enough to fix with nano, but still… odd results.

And had I not checked hosts.deny after running the script, I would have had to go to the basement and plug in a monitor to fix it. And that’s just not cool. :)

So what’s my conclusion?

Although it would appear that DenyHosts didn’t work too well, I’m still going to run it once in a while (not from cron as expected). I still think using port forwarding to run sshd on a non-standard port (i.e. something other than 22/tcp) is the best thing you can do to improve ssh security at your site. But I can see how a tool like this one could be potentially useful as well.

Update: Just to be clear… I didn’t read any of the docs and didn’t take the time to configure the script correctly. The script is cool. See Phil’s comments below.

This entry was posted on Thursday, January 19th, 2006 at 9:57 pm and is filed under Linux, Security, Software. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.