How To Install DenyHosts On Ubuntu 14.04 Server

DenyHosts is a python tool that monitors your webserver logs for activities that may signal a brute force attack against you. A brute force attack is a method used by bad guys to gain access to your servers using hundreds, sometimes thousands of random username and password combinations.

DenyHosts tool looks for these activities and try to stop these attacks by banning or blocking the IP addresses that are being used to attack your servers. It’s as simple as that.

This brief tutorial is going to show you how to install DenyHosts on Ubuntu 14.04 server to help prevent these attacks. There are many other methods that attackers may use against your servers, but using combinations of random username and passwords may not succeed because of DenyHosts.

Another way to protect yourself against brute force attack is by using encryption key to sign on your servers and disabling username/password logon. This is the most effective way, but may require a lot more work.

Currently DenyHosts isn’t available through Ubuntu default repository. Previously one would just run the apt-get command to install it. Not anymore.

To install DenyHosts, you must manually download and install it. I will show you how to do it below.

Visit DenyHosts home page and download a copy for you server. Or run the commands below to download version 2.8 (latest as of today’s date)

cd /tmp/ && wget http://downloads.sourceforge.net/project/denyhost/denyhost-2.9/denyhosts-2.9.tar.gz

Next, run the commands below to extract it.

tar xzf denyhosts*.tar.gz

Then run the commands below to change into the extracted folder

cd DenyHosts*

Finally, run the commands below to install the program

sudo python setup.py install

  注意：會輸出一堆信息，留意一下 denyhosts.py 的路徑，後面配置文件會用上

After running the commands above, DenyHosts will be installed on your server but not fully configured You must manually configure the tool.

Copy the daemon file to the /etc/init.d/ directory.

sudo cp /usr/local/bin/daemon-control-dist /etc/init.d/denyhosts

Next, open the script and make the below highlighted change

sudo vi /etc/init.d/denyhosts

###############################################
#### Edit these to suit your configuration ####
###############################################

DENYHOSTS_BIN = 「/usr/local/bin/denyhosts.py」  //替換上面輸出的 denyhosts.py ‍的路徑

 DENYHOSTS_LOCK = 「/run/denyhosts.pid」
DENYHOSTS_CFG = 「/etc/denyhosts.conf」

PYTHON_BIN = 「/usr/bin/env python」

 

Once installed, its configured and ready to protect your servers. One thing most webmasters do is go white-list their own IP address so they don’t get blocked or banned mistakenly.

To white-list your own IP address, open the allow host file in the /etc/ directory and add your IP address you use to connect to the server.

sudo vi /etc/hosts.allow

  把本身的常常訪問的IP 加入白名單

Then add your IP address in the file and save it.

# /etc/hosts.allow: list of hosts that are allowed to access the system.

# See the manual pages hosts_access(5) and hosts_options(5).
#
# Example: ALL: LOCAL @some_netgroup
# ALL: .foobar.edu EXCEPT terminalserver.foobar.edu
#
# If you’re going to protect the portmapper use the name 「rpcbind」 for the
# daemon name. See rpcbind(8) and rpc.mountd(8) for further information.
#
sshd: 172.145.33.45   直接編輯文件寫入 ip 一行一個

 

Restart DenyHosts by running the commands below.

sudo /etc/init.d/denyhosts start

 下面是安裝好的配置文件

DenyHosts configuration file is at  /etc/denyhosts.conf

vim /etc/denyhosts.conf

sshd 登陸日誌文件。不一樣系統的不同。 

SECURE_LOG = /var/log/auth.log

限制主機訪問的文件 

HOSTS_DENY = /etc/hosts.deny

 

移除 HOSTS_DENY 中超過如下時間的舊條目 

PURGE_DENY = 1w

 

阻止的服務。默認是 sshd ，能夠設置爲其餘或所有。 

BLOCK_SERVICE  = sshd

 

當該主機利用無效用戶進行登陸嘗試失敗超過如下的次數時，阻止該主機 

DENY_THRESHOLD_INVALID = 3

 

針對有效用戶的 

DENY_THRESHOLD_VALID = 4

 

針對 root 用戶的 

DENY_THRESHOLD_ROOT = 1

 

針對有限制的用戶的 

DENY_THRESHOLD_RESTRICTED = 1

 

DenyHosts 用於寫數據用的。在裏面能夠看到 hosts，hosts-root，offset，users-hosts，users-valid，hosts-restricted，hosts- valid，suspicious-logins，users-invalid 這些記錄。 

WORK_DIR = /var/lib/denyhosts

 

當爲 YES 時，若是容許的主機在登陸時被認爲可疑，則對該主機進行記錄。當爲 NO 時，若是容許的主機在登陸時被認爲可疑也不對該主機進行記錄。在容許的主機範圍外的主機的可疑登陸所有會被記錄。 

SUSPICIOUS_LOGIN_REPORT_ALLOWED_HOSTS=YES

 

反向域名解釋 

HOSTNAME_LOOKUP=NO

 

這個文件存在表示 Denyhosts 正在運行。用於保證每次只有一個實例在運行。 

LOCK_FILE = /var/run/denyhosts.pid

 

管理員 EMail 

ADMIN_EMAIL = root@localhost

 

SMTP 主機設置。若是有 SMTP 服務支持，能夠給管理員發郵件。 

SMTP_HOST = localhost 

SMTP_PORT = 25 

SMTP_FROM = DenyHosts <nobody@localhost> 

SMTP_SUBJECT = DenyHosts Report

 

若是在指定的時間內沒有失敗的登陸嘗試，將致使此主機的失敗計數重置爲0。此值適用於除了 root 以外，全部有效用戶(在 /etc/passwd 中的)的登陸嘗試。若是沒有定義，這個計數將永遠不會重置。 

AGE_RESET_VALID=5d

 

針對 root 用戶的 

AGE_RESET_ROOT=25d

 

針對有限制的用戶的 

AGE_RESET_RESTRICTED=25d

 

針對無效用戶(不在 /etc/passwd 中的) 

AGE_RESET_INVALID=1w

 

當登陸成功時，把登陸成功的失敗計數重置爲0。默認是 NO。 

#RESET_ON_SUCCESS = yes

 

當之後臺方式運行時，Denyhosts 的日誌文件，留空不記錄日誌。 

#DAEMON_LOG = /var/log/denyhosts

 

當之後臺方式運行時，每讀一第二天志文件的時間間隔。 

DAEMON_SLEEP = 30s

 

當之後臺方式運行時，清除機制在 HOSTS_DENY 中終止舊條目的時間間隔。 

DAEMON_PURGE = 1h

 

  重啓 Denyhosts 

sudo /etc/init.d/denyhosts restart

 查看攔截的 ip 文件在 

cat /ect/hosts.deny