防止ssh暴力破解软件 denyhosts
防止ssh暴力破解软件 denyhosts
无聊中查看了一下/var/log/secure日志，一看吓了一大跳。
Mar 31 15:21:32 rhel4 sshd[6057]: Failed password for invalid user kevin from ::ffff:211.192.211.98 port 64296 ssh2
Mar 31 15:21:33 rhel4 sshd[6059]: Invalid user kev from ::ffff:211.192.211.98
Mar 31 15:21:35 rhel4 sshd[6059]: Failed password for invalid user kev from ::ffff:211.192.211.98 port 64643 ssh2
Mar 31 15:21:37 rhel4 sshd[6061]: Invalid user kev from ::ffff:211.192.211.98
Mar 31 15:21:39 rhel4 sshd[6061]: Failed password for invalid user kev from ::ffff:211.192.211.98 port 64992 ssh2
Mar 31 15:21:40 rhel4 sshd[6063]: Invalid user hector from ::ffff:211.192.211.98
Mar 31 15:21:43 rhel4 sshd[6063]: Failed password for invalid user hector from ::ffff:211.192.211.98 port 1351 ssh2
Mar 31 15:21:44 rhel4 sshd[6065]: Invalid user harold from ::ffff:211.192.211.98
Mar 31 15:21:46 rhel4 sshd[6065]: Failed password for invalid user harold from ::ffff:211.192.211.98 port 1695 ssh2
Mar 31 15:21:48 rhel4 sshd[6067]: Invalid user homer from ::ffff:211.192.211.98
Mar 31 15:21:50 rhel4 sshd[6067]: Failed password for invalid user homer from ::ffff:211.192.211.98 port 2048 ssh2
Mar 31 15:21:51 rhel4 sshd[6069]: Invalid user simpson from ::ffff:211.192.211.98
Mar 31 15:21:54 rhel4 sshd[6069]: Failed password for invalid user simpson from ::ffff:211.192.211.98 port 2399 ssh2
Mar 31 15:21:55 rhel4 sshd[6071]: Invalid user helena from ::ffff:211.192.211.98
Mar 31 15:21:57 rhel4 sshd[6071]: Failed password for invalid user helena from ::ffff:211.192.211.98 port 2737 ssh2
Mar 31 15:21:59 rhel4 sshd[6073]: Invalid user selena from ::ffff:211.192.211.98
Mar 31 15:22:01 rhel4 sshd[6073]: Failed password for invalid user selena from ::ffff:211.192.211.98 port 3078 ssh2
Mar 31 15:22:02 rhel4 sshd[6075]: Invalid user helen from ::ffff:211.192.211.98
Mar 31 15:22:10 rhel4 sshd[6075]: Failed password for invalid user helen from ::ffff:211.192.211.98 port 3422 ssh2
Mar 31 15:22:11 rhel4 sshd[6077]: Invalid user helene from ::ffff:211.192.211.98
Mar 31 15:22:13 rhel4 sshd[6077]: Failed password for invalid user helene from ::ffff:211.192.211.98 port 4234 ssh2
Mar 31 15:22:15 rhel4 sshd[6079]: Invalid user gina from ::ffff:211.192.211.98
Mar 31 15:22:17 rhel4 sshd[6079]: Failed password for invalid user gina from ::ffff:211.192.211.98 port 4577 ssh2
Mar 31 15:22:18 rhel4 sshd[6081]: Invalid user francisc from ::ffff:211.192.211.98
Mar 31 15:22:21 rhel4 sshd[6081]: Failed password for invalid user francisc from ::ffff:211.192.211.98 port 4915 ssh2
Mar 31 15:22:22 rhel4 sshd[6083]: Invalid user fred from ::ffff:211.192.211.98
Mar 31 15:22:24 rhel4 sshd[6083]: Failed password for invalid user fred from ::ffff:211.192.211.98 port 5245 ssh2
Mar 31 15:22:26 rhel4 sshd[6087]: Invalid user frederic from ::ffff:211.192.211.98
Mar 31 15:22:28 rhel4 sshd[6087]: Failed password for invalid user frederic from ::ffff:211.192.211.98 port 5593 ssh2
Mar 31 15:22:29 rhel4 sshd[6090]: Invalid user felix from ::ffff:211.192.211.98
Mar 31 15:22:32 rhel4 sshd[6090]: Failed password for invalid user felix from ::ffff:211.192.211.98 port 5933 ssh2
Mar 31 15:22:33 rhel4 sshd[6092]: Invalid user filip from ::ffff:211.192.211.98
Mar 31 15:22:35 rhel4 sshd[6092]: Failed password for invalid user filip from ::ffff:211.192.211.98 port 6271 ssh2
Mar 31 15:22:37 rhel4 sshd[6094]: Invalid user philipe from ::ffff:211.192.211.98
Mar 31 15:22:39 rhel4 sshd[6094]: Failed password for invalid user philipe from ::ffff:211.192.211.98 port 6619 ssh2
Mar 31 15:22:40 rhel4 sshd[6096]: Invalid user bruce from ::ffff:211.192.211.98
Mar 31 15:22:43 rhel4 sshd[6096]: Failed password for invalid user bruce from ::ffff:211.192.211.98 port 6972 ssh2
Mar 31 15:22:44 rhel4 sshd[6098]: Invalid user ernest from ::ffff:211.192.211.98
Mar 31 15:22:46 rhel4 sshd[6098]: Failed password for invalid user ernest from ::ffff:211.192.211.98 port 7305 ssh2
Mar 31 15:22:48 rhel4 sshd[6100]: Invalid user luiza from ::ffff:211.192.211.98
Mar 31 15:22:50 rhel4 sshd[6100]: Failed password for invalid user luiza from ::ffff:211.192.211.98 port 7651 ssh2
Mar 31 15:22:51 rhel4 sshd[6102]: Invalid user edouard from ::ffff:211.192.211.98
Mar 31 15:21:33 rhel4 sshd[6059]: Invalid user kev from ::ffff:211.192.211.98
Mar 31 15:21:35 rhel4 sshd[6059]: Failed password for invalid user kev from ::ffff:211.192.211.98 port 64643 ssh2
Mar 31 15:21:37 rhel4 sshd[6061]: Invalid user kev from ::ffff:211.192.211.98
Mar 31 15:21:39 rhel4 sshd[6061]: Failed password for invalid user kev from ::ffff:211.192.211.98 port 64992 ssh2
Mar 31 15:21:40 rhel4 sshd[6063]: Invalid user hector from ::ffff:211.192.211.98
Mar 31 15:21:43 rhel4 sshd[6063]: Failed password for invalid user hector from ::ffff:211.192.211.98 port 1351 ssh2
Mar 31 15:21:44 rhel4 sshd[6065]: Invalid user harold from ::ffff:211.192.211.98
Mar 31 15:21:46 rhel4 sshd[6065]: Failed password for invalid user harold from ::ffff:211.192.211.98 port 1695 ssh2
Mar 31 15:21:48 rhel4 sshd[6067]: Invalid user homer from ::ffff:211.192.211.98
Mar 31 15:21:50 rhel4 sshd[6067]: Failed password for invalid user homer from ::ffff:211.192.211.98 port 2048 ssh2
Mar 31 15:21:51 rhel4 sshd[6069]: Invalid user simpson from ::ffff:211.192.211.98
Mar 31 15:21:54 rhel4 sshd[6069]: Failed password for invalid user simpson from ::ffff:211.192.211.98 port 2399 ssh2
Mar 31 15:21:55 rhel4 sshd[6071]: Invalid user helena from ::ffff:211.192.211.98
Mar 31 15:21:57 rhel4 sshd[6071]: Failed password for invalid user helena from ::ffff:211.192.211.98 port 2737 ssh2
Mar 31 15:21:59 rhel4 sshd[6073]: Invalid user selena from ::ffff:211.192.211.98
Mar 31 15:22:01 rhel4 sshd[6073]: Failed password for invalid user selena from ::ffff:211.192.211.98 port 3078 ssh2
Mar 31 15:22:02 rhel4 sshd[6075]: Invalid user helen from ::ffff:211.192.211.98
Mar 31 15:22:10 rhel4 sshd[6075]: Failed password for invalid user helen from ::ffff:211.192.211.98 port 3422 ssh2
Mar 31 15:22:11 rhel4 sshd[6077]: Invalid user helene from ::ffff:211.192.211.98
Mar 31 15:22:13 rhel4 sshd[6077]: Failed password for invalid user helene from ::ffff:211.192.211.98 port 4234 ssh2
Mar 31 15:22:15 rhel4 sshd[6079]: Invalid user gina from ::ffff:211.192.211.98
Mar 31 15:22:17 rhel4 sshd[6079]: Failed password for invalid user gina from ::ffff:211.192.211.98 port 4577 ssh2
Mar 31 15:22:18 rhel4 sshd[6081]: Invalid user francisc from ::ffff:211.192.211.98
Mar 31 15:22:21 rhel4 sshd[6081]: Failed password for invalid user francisc from ::ffff:211.192.211.98 port 4915 ssh2
Mar 31 15:22:22 rhel4 sshd[6083]: Invalid user fred from ::ffff:211.192.211.98
Mar 31 15:22:24 rhel4 sshd[6083]: Failed password for invalid user fred from ::ffff:211.192.211.98 port 5245 ssh2
Mar 31 15:22:26 rhel4 sshd[6087]: Invalid user frederic from ::ffff:211.192.211.98
Mar 31 15:22:28 rhel4 sshd[6087]: Failed password for invalid user frederic from ::ffff:211.192.211.98 port 5593 ssh2
Mar 31 15:22:29 rhel4 sshd[6090]: Invalid user felix from ::ffff:211.192.211.98
Mar 31 15:22:32 rhel4 sshd[6090]: Failed password for invalid user felix from ::ffff:211.192.211.98 port 5933 ssh2
Mar 31 15:22:33 rhel4 sshd[6092]: Invalid user filip from ::ffff:211.192.211.98
Mar 31 15:22:35 rhel4 sshd[6092]: Failed password for invalid user filip from ::ffff:211.192.211.98 port 6271 ssh2
Mar 31 15:22:37 rhel4 sshd[6094]: Invalid user philipe from ::ffff:211.192.211.98
Mar 31 15:22:39 rhel4 sshd[6094]: Failed password for invalid user philipe from ::ffff:211.192.211.98 port 6619 ssh2
Mar 31 15:22:40 rhel4 sshd[6096]: Invalid user bruce from ::ffff:211.192.211.98
Mar 31 15:22:43 rhel4 sshd[6096]: Failed password for invalid user bruce from ::ffff:211.192.211.98 port 6972 ssh2
Mar 31 15:22:44 rhel4 sshd[6098]: Invalid user ernest from ::ffff:211.192.211.98
Mar 31 15:22:46 rhel4 sshd[6098]: Failed password for invalid user ernest from ::ffff:211.192.211.98 port 7305 ssh2
Mar 31 15:22:48 rhel4 sshd[6100]: Invalid user luiza from ::ffff:211.192.211.98
Mar 31 15:22:50 rhel4 sshd[6100]: Failed password for invalid user luiza from ::ffff:211.192.211.98 port 7651 ssh2
Mar 31 15:22:51 rhel4 sshd[6102]: Invalid user edouard from ::ffff:211.192.211.98
好多类似上面的攻击，可以看到用户在一个一个测试用户名和密码，汗！！！
立即处理该问题，用GOOGLE搜索了一下，找到一个软件denyhosts。
先从网络上下载该软件，我下载的是denyhosts-2.6.tar.gz
解压缩，进入源目录，直接安装
enyHosts是用Python2.3写的一个程序，所以安装起来和普通LINUX安装文件有所不同
1首选检查Sshd是否支持Tcpwrap，只有支持Tcpwrap才可以安装Denyhost
ldd /usr/sbin/sshd |grep wrap
ldd /usr/sbin/sshd |grep wrap
2需要检查Python的版本，Python2.3以上版本可以直接安装 python �CV
我安装的RHEL4.0,这里都OK了
3进入解压缩后的目录，执行安装python setup.py install
程序脚本自动安装到/usr/share/denyhosts
库文件自动安装到/usr/lib/python2.3/site- packages/DenyHosts
denyhosts.py自动安装到/usr/bin
4 cd /usr/share/denyhosts/拷贝模板文件
库文件自动安装到/usr/lib/python2.3/site- packages/DenyHosts
denyhosts.py自动安装到/usr/bin
4 cd /usr/share/denyhosts/拷贝模板文件
5 cp daemon-control-dist daemon-control设置好启动脚本的所属用户和权限
6 chown root daemon-control
7 chmod 700 daemon-control生成Denyhost的主配置文件，（将模板文件中开头是#的过滤后再导入到Denyhost.cfg）
8 grep -v "^#" denyhosts.cfg-dist > denyhosts.cfg
编辑Denyhost.cfg文件
编辑Denyhost.cfg文件
9 vi denyhosts.cfg
----------------denyhosts.cfg------------------------
SECURE_LOG = /var/log/secure
SECURE_LOG = /var/log/secure
#RedHat/Fedora Core
分析该日志文件
# 其它版本 linux 根据 denyhosts.cfg-dist 内提示选择。 PURGE_DENY = 30m
# 过多久后清除
# 其它版本 linux 根据 denyhosts.cfg-dist 内提示选择。 PURGE_DENY = 30m
# 过多久后清除
DENY_THRESHOLD_INVALID = 1
#
允许无效用户（
/etc/passwd
未列出）登录失败的次数
DENY_THRESHOLD_VALID = 5
#
允许有效（普通）用户登录失败的次数
DENY_THRESHOLD_ROOT = 3
# 允许 root 登录失败的次数
HOSTNAME_LOOKUP=NO
# 是否做域名反解
----------------denyhosts.cfg------------------------
# 允许 root 登录失败的次数
HOSTNAME_LOOKUP=NO
# 是否做域名反解
----------------denyhosts.cfg------------------------
将
Denyhost
启动脚本添加到自动启动中
10
echo '/usr/share/denyhosts/daemon-control start'>>/etc/rc.d/rc.local
启动Denyhost
的进程
11
/usr/share/denyhosts/daemon-control start
可以查看到Denyhost
在运行中
12
ps -ef |grep deny
在另外一台机器上使用Ssh
进行连接，当在连续几次输入错误的密码后，会被自动阻止掉，在一定时内不可以再连接
Ssh
连接记录的日志文件
13
tail /var/log/secure �Cf
本地实例
Mar 31 20:21:48 rhel4 sshd[11225]: Failed password for root from ::ffff:114.245.149.223 port 2039 ssh2
Mar 31 20:21:54 rhel4 sshd[11225]: Accepted password for root from ::ffff:114.245.149.223 port 2039 ssh2
Mar 31 22:21:46 rhel4 sshd[14205]: Failed password for root from ::ffff:173.45.67.210 port 42075 ssh2
Mar 31 22:21:51 rhel4 sshd[14211]: Failed password for root from ::ffff:173.45.67.210 port 42422 ssh2
Mar 31 22:21:56 rhel4 sshd[14216]: Failed password for root from ::ffff:173.45.67.210 port 42749 ssh2
Mar 31 22:22:01 rhel4 sshd[14222]: Failed password for root from ::ffff:173.45.67.210 port 43100 ssh2
Mar 31 22:22:05 rhel4 sshd[14224]: Failed password for root from ::ffff:173.45.67.210 port 43454 ssh2
Mar 31 22:22:20 rhel4 sshd[14230]: Failed password for root from ::ffff:173.45.67.210 port 43768 ssh2
Apr 1 09:15:28 rhel4 sshd[30696]: Accepted password for root from ::ffff:211.155.190.247 port 52048 ssh2
Mar 31 20:21:54 rhel4 sshd[11225]: Accepted password for root from ::ffff:114.245.149.223 port 2039 ssh2
Mar 31 22:21:46 rhel4 sshd[14205]: Failed password for root from ::ffff:173.45.67.210 port 42075 ssh2
Mar 31 22:21:51 rhel4 sshd[14211]: Failed password for root from ::ffff:173.45.67.210 port 42422 ssh2
Mar 31 22:21:56 rhel4 sshd[14216]: Failed password for root from ::ffff:173.45.67.210 port 42749 ssh2
Mar 31 22:22:01 rhel4 sshd[14222]: Failed password for root from ::ffff:173.45.67.210 port 43100 ssh2
Mar 31 22:22:05 rhel4 sshd[14224]: Failed password for root from ::ffff:173.45.67.210 port 43454 ssh2
Mar 31 22:22:20 rhel4 sshd[14230]: Failed password for root from ::ffff:173.45.67.210 port 43768 ssh2
Apr 1 09:15:28 rhel4 sshd[30696]: Accepted password for root from ::ffff:211.155.190.247 port 52048 ssh2
Denyhost
日志文件
14
tail /var/log/denyhosts �Cf
[root@rhel4 ~]# tail /var/log/denyhosts -f
2009-04-01 09:27:48,571 - denyfileutil: INFO num entries purged: 0
2009-04-01 10:19:18,106 - denyhosts : INFO /var/log/secure has been rotated
2009-04-01 10:19:20,170 - denyhosts : INFO new denied hosts: ['173.45.67.210', '61.191.53.99', '211.155.190.247', '63.216.183.4', '211.80.157.210', '204.110.14.16', '121.174.8.16', '221.221.255.121', '60.195.250.54', '211.192.211.98', '222.218.156.41', '222.87.0.97', '219.153.66.71']
2009-04-01 10:27:50,097 - denyfileutil: INFO purging entries older than: Wed Apr 1 09:57:50 2009
2009-04-01 10:27:50,099 - denyfileutil: INFO num entries purged: 0
2009-04-01 11:27:49,562 - denyfileutil: INFO purging entries older than: Wed Apr 1 10:57:49 2009
2009-04-01 11:27:49,564 - loginattempt: INFO purging_hosts: ['173.45.67.210', '61.191.53.99', '211.155.190.247', '63.216.183.4', '211.80.157.210', '204.110.14.16', '121.174.8.16', '221.221.255.121', '60.195.250.54', '211.192.211.98', '222.218.156.41', '222.87.0.97', '219.153.66.71']
2009-04-01 11:27:49,565 - denyfileutil: INFO num entries purged: 13
2009-04-01 12:27:49,033 - denyfileutil: INFO purging entries older than: Wed Apr 1 11:57:49 2009
2009-04-01 12:27:49,034 - denyfileutil: INFO num entries purged: 0
2009-04-01 09:27:48,571 - denyfileutil: INFO num entries purged: 0
2009-04-01 10:19:18,106 - denyhosts : INFO /var/log/secure has been rotated
2009-04-01 10:19:20,170 - denyhosts : INFO new denied hosts: ['173.45.67.210', '61.191.53.99', '211.155.190.247', '63.216.183.4', '211.80.157.210', '204.110.14.16', '121.174.8.16', '221.221.255.121', '60.195.250.54', '211.192.211.98', '222.218.156.41', '222.87.0.97', '219.153.66.71']
2009-04-01 10:27:50,097 - denyfileutil: INFO purging entries older than: Wed Apr 1 09:57:50 2009
2009-04-01 10:27:50,099 - denyfileutil: INFO num entries purged: 0
2009-04-01 11:27:49,562 - denyfileutil: INFO purging entries older than: Wed Apr 1 10:57:49 2009
2009-04-01 11:27:49,564 - loginattempt: INFO purging_hosts: ['173.45.67.210', '61.191.53.99', '211.155.190.247', '63.216.183.4', '211.80.157.210', '204.110.14.16', '121.174.8.16', '221.221.255.121', '60.195.250.54', '211.192.211.98', '222.218.156.41', '222.87.0.97', '219.153.66.71']
2009-04-01 11:27:49,565 - denyfileutil: INFO num entries purged: 13
2009-04-01 12:27:49,033 - denyfileutil: INFO purging entries older than: Wed Apr 1 11:57:49 2009
2009-04-01 12:27:49,034 - denyfileutil: INFO num entries purged: 0
Denyhost
将恶意连接的
IP
记录到
Hosts.deny
文件中，过一定时间后再从该文件中清除（
Denyhost.cfg
中设定的时间）
15
vi /etc/hosts.deny
# DenyHosts: Tue Mar 31 16:27:57 2009 | sshd: 173.45.67.210
sshd: 173.45.67.210
# DenyHosts: Tue Mar 31 16:27:57 2009 | sshd: 61.191.53.99
sshd: 61.191.53.99
# DenyHosts: Tue Mar 31 16:27:57 2009 | sshd: 63.216.183.4
sshd: 63.216.183.4
# DenyHosts: Tue Mar 31 16:27:57 2009 | sshd: 211.80.157.210
sshd: 211.80.157.210
# DenyHosts: Tue Mar 31 16:27:57 2009 | sshd: 204.110.14.16
sshd: 204.110.14.16
# DenyHosts: Tue Mar 31 16:27:57 2009 | sshd: 121.174.8.16
sshd: 121.174.8.16
sshd: 173.45.67.210
# DenyHosts: Tue Mar 31 16:27:57 2009 | sshd: 61.191.53.99
sshd: 61.191.53.99
# DenyHosts: Tue Mar 31 16:27:57 2009 | sshd: 63.216.183.4
sshd: 63.216.183.4
# DenyHosts: Tue Mar 31 16:27:57 2009 | sshd: 211.80.157.210
sshd: 211.80.157.210
# DenyHosts: Tue Mar 31 16:27:57 2009 | sshd: 204.110.14.16
sshd: 204.110.14.16
# DenyHosts: Tue Mar 31 16:27:57 2009 | sshd: 121.174.8.16
sshd: 121.174.8.16
查看denyhosts查看
/usr/share/denyhosts/daemon-control status
DenyHosts is running with pid = 28144
DenyHosts is running with pid = 28144
如何开开始状态继续使用start命令，会有报错：
[root@rhel4 subsys]# /usr/share/denyhosts/daemon-control start
starting DenyHosts: /usr/bin/env python /usr/bin/denyhosts.py --daemon --config=/usr/share/denyhosts/denyhosts.cfg
DenyHosts could not obtain lock (pid: 28144)
[Errno 17] File exists: '/var/lock/subsys/denyhosts'
starting DenyHosts: /usr/bin/env python /usr/bin/denyhosts.py --daemon --config=/usr/share/denyhosts/denyhosts.cfg
DenyHosts could not obtain lock (pid: 28144)
[Errno 17] File exists: '/var/lock/subsys/denyhosts'
如何先查看状态，如果没有启用，在使用start命令