Introduction
DenyHosts is a script intended to be running by Linux system administrators in order to help thwart SSH server attacks (also known as dictionary based attacks and brute force attacks). Thanks to its simplicity and the ability to manually configure the rules DenyHost is widely used as an alternative to Fail2ban which is a bit more complicated to use and configure.
DenyHosts is an open source and free log-based intrusion prevention security program for SSH servers developed in Python language. It is intended to monitor and analyze SSH server logs for invalid login attempts, dictionary based attacks and brute force attacks by blocking the originating IP addresses via the adding of an entry to /etc/hosts.deny file on the server and prevents the IP address from making any further such login attempts.
In this tutorial we will show you how you can install and configure DenyHosts on your CentOS 6 server. It is simple and easy to installa and configure and use.
Features
From its various features we list the following ones from its official site.
- Parses /var/log/secure to find all login attempts and filters failed and successful attempts.
- Synchronization mode (new in 2.0) allows DenyHosts daemons the ability to share data via a centralized server to proactively thwart attacks.
- Can be run from the command line, cron or as a daemon (new in 0.9)
- Records all failed login attempts for the user and offending host
- For each host that exceeds a threshold count, records the evil host
- Keeps track of each non-existent user (eg. sdadasd) when a login attempt failed.
- Keeps track of each existing user (eg. root) when a login attempt failed.
- Keeps track of each offending host (with 0.8+ these hosts can be purged if the associated entry in /etc/hosts.deny is expired)
- Keeps track of suspicious logins (that is, logins that were successful for a host that had many login failures)
- Keeps track of the file offset, so that you can reparse the same file (/var/log/secure) continuously (until it is rotated).
- When the log file is rotated, the script will detect it and parse from the beginning.
- Appends /etc/hosts.deny and adds the newly banned hosts
- Optionally sends an email of newly banned hosts and suspicious logins.
- Keeps a history of all user, host, user/host combo and suspicious logins encountered which includes the data and number of corresponding failed login attempts.
- Maintains failed valid and invalid user login attempts in separate files, such that it is easy to see which valid user is under attack (which would give you the opportunity to remove the account, change the password or change it’s default shell to something like /sbin/nologin
- Upon each run, the script will load the previously saved data and re-use it to append new failures.
- Resolves IP addresses to hostnames, if available (new in v0.6.0).
- /etc/hosts.deny entries can be expired (purge) at a user specified time (new in 0.8)
- FreeBSD support (added in 0.7)
Prerequisites
Before starting, make sure you have a CentOS 6 server already configured with a static IP address.
Installation and configuration of DenyHost on CentOS 6
Step 1:
Before starting, we will check if our server is fully up to date by using the following command:
yum update
After being sure that the server is up to date we can start the installation.
Step 2:
Now, we will use the following command to download the EPEL repository:
sudo rpm -Uvh http://mirror.metrocast.net/fedora/epel/6/i386/epel-release-6-8.noarch.rpm
And to install the DenyHost packages we will use the following command:
sudo yum install denyhosts
You have to be careful that you have prevented your DenyHost’s server IP address from being denied during the installation. We will use the following command now:
nano /etc/hosts.allow
And the following command to protect our address IP, you can find your address IP within this link. Don’t forget to replace “You_IP” with your address:
sshd: Your_IP
Now we will block everything. So we will use the nano editor to open the file:
nano /etc/hosts.deny
And using the following line we will edit the file by adding it to the button of the file:
sshd: ALL **
Then we will save and restart DenyHost using the following command:
/etc/init.d/denyhosts restart
And if you want to make any configuration of your installed DenyHost you have to open the following file and update it according to your preference:
nano /etc/denyhosts.conf
Step 3:
To check denyhosts ssh logs to know how many attackers and hackers are attempted to gain access to your server use the following command:
# tail -f /var/log/secure
And if you want to remove a banned IP address from the denyhosts, use the following command to stop denyhost firstly:
# /etc/init.d/denyhosts stop
And then use the following lines to remove or delete the banned IP address completely:
# nano /etc/hosts.deny # nano /var/lib/denyhosts/hosts # nano /var/lib/denyhosts/hosts-restricted # nano /var/lib/denyhosts/hosts-root # nano /var/lib/denyhosts/hosts-valid # nano /var/lib/denyhosts/users-hosts
After removing the banned IP address, you have to restart the denyhost using the following command:
# /etc/init.d/denyhosts start
If you want to find a specific address IP, the easiest way is to use the grep command like the following example by replacing wanted_IP with your selected address:
#cd /var/lib/denyhosts
grep wanted_IP *
Conclusion
In this tutorial, we discussed how to install and configure DenyHosts on your CentOs 6 server. Also, we showed you how to defend against brute force attacks. As far as I know, It is easy to configure and it also supports email, smtp, and syslog notifications. Hope this tool will be useful for you sometime.
Cheers!
Reference link:
