Centos安装denyhosts

Denyhosts我们通常用来抵御ssh字典攻击。
Denyhosts是采用python写的，需要python环境(现在linux都有python环境)
Denyhosts是通过分析/var/log/secure日志文件中登陆失败，结合设置的策略，进行对应防护措施（比如：检测到同一IP，在一分钟之内尝试错误连接100次，很明显就应该拒绝此IP继续ssh连接，拒绝的策略是写入到/etc/hosts.deny配置文件中）

安装：

# epel源中
# yum install denyhosts -y
# rpm -ql denyhosts
#     /etc/denyhosts.conf       //规则配置文件
#     /etc/rc.d/init.d/denyhosts       //服务脚本
#     /var/log/denyhosts       //日志文件
#     /var/lib/denyhosts       //denyhost 工作目录
#  denyhosts数据文件，看名字大概知道
#  /var/lib/denyhosts/allowed-hosts
#  /var/lib/denyhosts/allowed-warned-hosts
#  /var/lib/denyhosts/hosts
#  /var/lib/denyhosts/hosts-restricted
#  /var/lib/denyhosts/hosts-root
#  /var/lib/denyhosts/hosts-valid
#  /var/lib/denyhosts/offset
#  /var/lib/denyhosts/suspicious-logins
#  /var/lib/denyhosts/sync-hosts
#  /var/lib/denyhosts/users-hosts
#  /var/lib/denyhosts/users-invalid
#  /var/lib/denyhosts/users-valid

配置

# grep -Ev '^#|^$' /etc/denyhosts.conf   
 ############ THESE SETTINGS ARE REQUIRED ############
SECURE_LOG = /var/log/secure
HOSTS_DENY = /etc/hosts.deny
PURGE_DENY = 4w        // ip被禁止之后，多久可以释放(w表示周，d表示天，h表示小时，m表示分钟)
BLOCK_SERVICE  = sshd     // 检测的服务
DENY_THRESHOLD_INVALID = 5     // 无效用户尝试次数之后即被锁定
DENY_THRESHOLD_VALID = 10      //  有效普通用户尝试次数
DENY_THRESHOLD_ROOT = 1       //   root用户尝试次数
DENY_THRESHOLD_RESTRICTED = 1    // 设定denyhosts将数据写入到/etc/hosts.deny文件中
WORK_DIR = /var/lib/denyhosts      //denyhosts工作数据目录
SUSPICIOUS_LOGIN_REPORT_ALLOWED_HOSTS=YES
HOSTNAME_LOOKUP=YES     // 域名解析
LOCK_FILE = /var/lock/subsys/denyhosts
 ############ THESE SETTINGS ARE OPTIONAL ############
ADMIN_EMAIL = root
SMTP_HOST = localhost
SMTP_PORT = 25
SMTP_FROM = DenyHosts 
SMTP_SUBJECT = DenyHosts Report from $[HOSTNAME]
AGE_RESET_VALID=5d           //普通有效用户登陆计数清零时间
AGE_RESET_ROOT=25d        //root用户登陆计数清零时间
AGE_RESET_RESTRICTED=25d     // /etc/hosts.deny文件清除数据时间
AGE_RESET_INVALID=10d
 ######### THESE SETTINGS ARE SPECIFIC TO DAEMON MODE  ##########
DAEMON_LOG = /var/log/denyhosts
DAEMON_SLEEP = 30s
DAEMON_PURGE = 1h
 #########   THESE SETTINGS ARE SPECIFIC TO     ##########
 #########       DAEMON SYNCHRONIZATION         ##########

启动服务

# service denyhosts start
# chkconfig denyhosts on

测试

开启两个ssh进程，一个用来测试，一个用来等会解除限制
多次尝试无效用户登陆，发现之后就不会在让你到输入用户密码界面，检查数据
# cat /etc/hosts.deny
# DenyHosts: Wed Feb 22 16:15:51 2017 | sshd: 113.102.163.146
sshd: 113.102.163.146
# cat /var/lib/denyhosts/* | grep 113.102.163.146
# 113.102.163.146:7:Wed Feb 22 16:15:51 2017
# 113.102.163.146:0:Wed Feb 22 16:13:51 2017
# 113.102.163.146:0:Wed Feb 22 16:13:51 2017
# 113.102.163.146:0:Wed Feb 22 16:13:51 2017

denyhosts恢复

清楚文件对应的数据，重启rsyslog服务器重置计数器
# sed -i '/113.102.163.146/d' /etc/hosts.deny
# sed -i '/113.102.163.146/d' /var/lib/denyhosts/*
# service rsyslog restart