Hi,

I'm configuring DenyHosts to protect myself from brute force ssh attacks after noticing my machine sat on the web had some attempts from an IP in china.

I've installed and configured and its running fine after some initial .lock file problems.

The wierd thing is it puts the IP address of my main desktop machine (which I use to connect via public key) straight into the /etc/hosts.deny file. Even wierder is that I can still connect despite this!

If I manually remove the false entry from /etc/hosts.deny, denyhosts will shove it back in there within 10 seconds.

Any ideas? I'm totally stumped why it is doing this, and more important perhaps, why /etc/hosts.deny isn't denying access from my desktop machine.

The entry looks like;

sshd : x.x.x.x

The only thing may be causing a problem is that my ssh port is off 22.

Thanks

Is there a reason why you have some deamon running to handle this rather than just manually editing your hosts.allow & hosts.deny?

I deny everything then allow certain entries through hosts.allow. Works great. No "denyhosts" program needed. I can see all the thwarted login attempts /var/log/auth.log so I know it's working.

fyi, my hosts.deny looks like so:

ALL: PARANOID

... and hosts.allow has a bunch of:

sshd: x.x.x.x

entries for explicitly allowed ips.

Adding entries for each user would be very hard in my case. They log on remotely from home, from other sites etc etc.

I think I might have nailed the problem though, and blindingly obvious it was. I had a previous failed attempt from my desktop IP when I was messing around earlier. Of course thats in /var/log/messages and when the daemon parses the log file (I presume it does the entire file when first started up), it finds that IP and adds it to hosts.deny.

I would recommend adding the users who are allowed to use ssh to a group that you create for that purpose. For example, let's say you call the group "sshusers".
Then add the line:
AllowGroups sshusers
to your sshd_config file. This will deny all other groups including system groups which are subject to brute force attacks. I think in your case this would be easier to manage than adding each user to "AllowUsers".

Moving the port that ssh listens to will help reduce the number of brute force attacks as well. A determined hacker will still be able to scan for the ssh port being used, but most will move on to another computer.

Since the attack is coming from a single IP address, consider blocking it in the firewall. You may even be able to block it in your NAT router to protect all of your hosts. Also consider blocking the group of IPs that are assigned to China, since that country is so active in hacking. Many companies who don't do business with China will do that to protect their mail servers.

If you use PAM for ssh, then read through the "man 5 access.conf" for the syntax of /etc/security/access.conf.
There is also a "man 5 hosts_access" manpage.

It may be better to instead not use PAM and instead rely on keys as the only form of authentication. Using search on this site for "ssh" should provide plenty of posts with examples. Also check this sites wiki. If you have a user with a common user name like "God" or "bob" and a weak password, then you could still be vulnerable. You probably want to have your system reject weak passwords to protect other services as well.
See man pam_pwcheck for a possible solution. Your distro may have a convenient gui config to enforce this as well.

Thanks for your ideas

The group make particular sense tbh.

Another option:

1. edit denyhosts.conf and find PURGE_DENY, change to 1m (1 minute)
2. stop denyhosts
3. start denyhosts with --purge option

after your IP clear from hosts.deny, put back PURGE_DENY time to your taste then restart denyhosts.

I'll bet you have an entry in hosts.allow that is overriding the entry in hosts.deny.

DenyHosts works by scanning syslog files looking for sshd login failure messages. Just removing the entry from hosts.deny won't work. You have to edit the configured syslog file (check denyhosts.cfg), remove all your own login failures and bounce the denyhosts daemon to get it to not re-add the IP address you want to re-allow.

I have found this script to be very helpful:

http://www.aczoom.com/cms/blockhosts

It halts the brute force attempts on ssh by blocking them (in hosts.allow and optionally in the iptables firewall) after a user configurable number of tries (I allow 5 tries). This does two things; first, it stops anyone who is really determined and might get lucky from actually making a connection, and second it cuts way down on the size of the auth.log file.

Ummm, that's exactly what denyhosts does too.

Yes, I figured that out when I googled denyhosts after posting. However the way they do it is a bit different.

Blockhosts expects to get run from tcpwrappers, as a spawn from hosts.allow, while denyhosts is a daemon. Having not studied denyhosts in any detail, I won't offer an opinion on the advantages or disadvantages of each method, but blockhosts only runs when needed, and doesn't routinely clean up old blocked entries until it runs. Also, denyhosts has its mechanism for reporting blocked hosts to a central database which is shared. This may or may not be an advantage, but it is certainly something that blockhosts does not do.

Edit /usr/share/denyhosts/data/allowed-hosts and put a list of IPs there that are NEVER to be denied access, no matter how many times they fail their login.