How To Install DenyHosts On Ubuntu 14.04 Server

DenyHosts is a python tool that monitors your webserver logs for activities that may signal a brute force attack against you. A brute force attack is a method used by bad guys to gain access to your servers using hundreds, sometimes thousands of random username and password combinations.

DenyHosts tool looks for these activities and try to stop these attacks by banning or blocking the IP addresses that are being used to attack your servers. It’s as simple as that.

This brief tutorial is going to show you how to install DenyHosts on Ubuntu 14.04 server to help prevent these attacks. There are many other methods that attackers may use against your servers, but using combinations of random username and passwords may not succeed because of DenyHosts.

Another way to protect yourself against brute force attack is by using encryption key to sign on your servers and disabling username/password logon. This is the most effective way, but may require a lot more work.

Currently DenyHosts isn’t available through Ubuntu default repository. Previously one would just run the apt-get command to install it. Not anymore.

To install DenyHosts, you must manually download and install it. I will show you how to do it below.

Visit DenyHosts home page and download a copy for you server. Or run the commands below to download version 2.8 (latest as of today’s date)

cd /tmp/ && wget http://downloads.sourceforge.net/project/denyhost/denyhost-2.9/denyhosts-2.9.tar.gz

Next, run the commands below to extract it.

tar xzf denyhosts*.tar.gz

Then run the commands below to change into the extracted folder

cd DenyHosts*

Finally, run the commands below to install the program

sudo python setup.py install

  注意：会输出一堆信息，留意一下 denyhosts.py 的路径，后面配置文件会用上

After running the commands above, DenyHosts will be installed on your server but not fully configured You must manually configure the tool.

Copy the daemon file to the /etc/init.d/ directory.

sudo cp /usr/local/bin/daemon-control-dist /etc/init.d/denyhosts

Next, open the script and make the below highlighted change

sudo vi /etc/init.d/denyhosts

###############################################
#### Edit these to suit your configuration ####
###############################################

DENYHOSTS_BIN = “/usr/local/bin/denyhosts.py”  //替换上面输出的 denyhosts.py ‍的路径

 DENYHOSTS_LOCK = “/run/denyhosts.pid”
DENYHOSTS_CFG = “/etc/denyhosts.conf”

PYTHON_BIN = “/usr/bin/env python”

 

Once installed, its configured and ready to protect your servers. One thing most webmasters do is go white-list their own IP address so they don’t get blocked or banned mistakenly.

To white-list your own IP address, open the allow host file in the /etc/ directory and add your IP address you use to connect to the server.

sudo vi /etc/hosts.allow

  把自己的经常访问的IP 加入白名单

Then add your IP address in the file and save it.

# /etc/hosts.allow: list of hosts that are allowed to access the system.

# See the manual pages hosts_access(5) and hosts_options(5).
#
# Example: ALL: LOCAL @some_netgroup
# ALL: .foobar.edu EXCEPT terminalserver.foobar.edu
#
# If you’re going to protect the portmapper use the name “rpcbind” for the
# daemon name. See rpcbind(8) and rpc.mountd(8) for further information.
#
sshd: 172.145.33.45   直接编辑文件写入 ip 一行一个

 

Restart DenyHosts by running the commands below.

sudo /etc/init.d/denyhosts start

 下面是安装好的配置文件

DenyHosts configuration file is at  /etc/denyhosts.conf

vim /etc/denyhosts.conf

sshd 登录日志文件。不同系统的不一样。 

SECURE_LOG = /var/log/auth.log

限制主机访问的文件 

HOSTS_DENY = /etc/hosts.deny

 

移除 HOSTS_DENY 中超过以下时间的旧条目 

PURGE_DENY = 1w

 

阻止的服务。默认是 sshd ，可以设置为其他或全部。 

BLOCK_SERVICE  = sshd

 

当该主机利用无效用户进行登录尝试失败超过以下的次数时，阻止该主机 

DENY_THRESHOLD_INVALID = 3

 

针对有效用户的 

DENY_THRESHOLD_VALID = 4

 

针对 root 用户的 

DENY_THRESHOLD_ROOT = 1

 

针对有限制的用户的 

DENY_THRESHOLD_RESTRICTED = 1

 

DenyHosts 用于写数据用的。在里面可以看到 hosts，hosts-root，offset，users-hosts，users-valid，hosts-restricted，hosts- valid，suspicious-logins，users-invalid 这些记录。 

WORK_DIR = /var/lib/denyhosts

 

当为 YES 时，如果允许的主机在登录时被认为可疑，则对该主机进行记录。当为 NO 时，如果允许的主机在登录时被认为可疑也不对该主机进行记录。在允许的主机范围外的主机的可疑登录全部会被记录。 

SUSPICIOUS_LOGIN_REPORT_ALLOWED_HOSTS=YES

 

反向域名解释 

HOSTNAME_LOOKUP=NO

 

这个文件存在表示 Denyhosts 正在运行。用于保证每次只有一个实例在运行。 

LOCK_FILE = /var/run/denyhosts.pid

 

管理员 EMail 

ADMIN_EMAIL = root@localhost

 

SMTP 主机设置。如果有 SMTP 服务支持，可以给管理员发邮件。 

SMTP_HOST = localhost 

SMTP_PORT = 25 

SMTP_FROM = DenyHosts <nobody@localhost> 

SMTP_SUBJECT = DenyHosts Report

 

如果在指定的时间内没有失败的登录尝试，将导致此主机的失败计数重置为0。此值适用于除了 root 之外，所有有效用户(在 /etc/passwd 中的)的登录尝试。如果没有定义，这个计数将永远不会重置。 

AGE_RESET_VALID=5d

 

针对 root 用户的 

AGE_RESET_ROOT=25d

 

针对有限制的用户的 

AGE_RESET_RESTRICTED=25d

 

针对无效用户(不在 /etc/passwd 中的) 

AGE_RESET_INVALID=1w

 

当登录成功时，把登录成功的失败计数重置为0。默认是 NO。 

#RESET_ON_SUCCESS = yes

 

当以后台方式运行时，Denyhosts 的日志文件，留空不记录日志。 

#DAEMON_LOG = /var/log/denyhosts

 

当以后台方式运行时，每读一次日志文件的时间间隔。 

DAEMON_SLEEP = 30s

 

当以后台方式运行时，清除机制在 HOSTS_DENY 中终止旧条目的时间间隔。 

DAEMON_PURGE = 1h

 

  重启 Denyhosts 

sudo /etc/init.d/denyhosts restart

 查看拦截的 ip 文件在 

cat /ect/hosts.deny