How to: Block SSH attacks with denyhosts

Block SSH Attacks
Block SSH Attacks using DenyHosts

How to set up denyhosts python script to block SSH attacks on Sabayon 4.1 KDE

**This is a legacy article which does not meet some of our quality standards. While it may contain useful information, is retained here for legacy reasons only.**


This is a great way to fix those annoying hacking attempts in your /var/log/messages file.  I get ton’s of attempts like the below as an example.  The whois queries all say they come from Russia and according to the firewall is creating the most traffic accross my router.  So this is why you use Denyhosts.  I did used to use blockhosts (also in python) but denyhosts is supposed to be better so I thought I’d give it a go.

Jun  1 12:12:50 Donald sshd[23635]: Invalid user yonamine from
Jun  1 12:12:58 Donald sshd[23674]: Invalid user yonchun from
Jun  1 12:13:07 Donald sshd[23724]: Invalid user yoneda from
Jun  1 12:13:15 Donald sshd[23765]: Invalid user yoneko from
Jun  1 12:13:24 Donald sshd[23807]: Invalid user yonekura from
Jun  1 12:13:33 Donald sshd[23851]: Invalid user yonemitsu from
Jun  1 12:13:41 Donald sshd[23895]: Invalid user yonemoto from

Get the source code

Download the latest source tarball of Denyhosts from (at time of writing this is version 2.6)

Extract it

tar -zxvf Denyhostsxxxx.tar.gz

$ cd denyhostsxxx

$ su (become root)

Configure syslog-ng

# vi /etc/syslog-ng/syslog-ng.conf

Underneath the line that reads: “destination messages { file(“/var/log/messages”); };”

Enter the following:

destination authlog { file("/var/log/auth.log"); };

Save the file and exit

# touch /var/log/auth.log

# /etc/init.d/syslog-ng restart

Configure denyhosts

# cd /usr/share/denyhosts/

# python install

This installs DenyHosts to /usr/share/denyhosts

# cp denyhosts.cfg-dist denyhosts.cfg

Edit the denyhosts.cfg file

# vi /usr/share/denyhosts/denyhosts.cfg

Ensure the SECURE_LOG line reads as below

SECURE_LOG = /var/log/auth.log

Also ensure the lock file reads

LOCK_FILE = /var/run/

Save the file and exit.

Make it daemonise

# cd /usr/share/denyhosts/

# cp daemon-control-dist daemon-control

Edit /usr/share/denyhosts/daemon-control and make sure you set the correct values for DENYHOSTS_BIN, DENYHOSTS_LOCK, and DENYHOSTS_CFG. (Should just be the lock file that needs to be changed)

# vi /usr/share/denyhosts/daemon-control

DENYHOSTS_BIN = “/usr/bin/”
DENYHOSTS_LOCK = “/var/run/”
DENYHOSTS_CFG = “/usr/share/denyhosts/denyhosts.cfg

Next we have to make that file executable:

# chown root /usr/share/denyhosts/daemon-control

# chmod 700 /usr/share/denyhosts/daemon-control

Make it start automatically at system boot time

Afterwards, we create the system bootup links for DenyHosts do that it is started automatically when the system is booted:

# cd /etc/init.d
# ln -s /usr/share/denyhosts/daemon-control denyhosts
# rc-update add denyhosts default

Finally, we start DenyHosts:

/etc/init.d/denyhosts start

That’s it!

Further info

DenyHosts logs to /var/log/denyhosts, if you are interested in the logs. The SSH daemon logs to /var/log/auth.log on Sabayon. You can watch both logs and try to log in with an invalid user or with a valid user and incorrect password, etc. via SSH and see what happens. After you have crossed the threshold of incorrect login attempts, the IP address from which you tried to connect should get listed in /etc/hosts.deny, like this:

# /etc/hosts.deny: list of hosts that are _not_ allowed to access the system.
#                  See the manual pages hosts_access(5), hosts_options(5)
#                  and /usr/doc/netbase/portmapper.txt.gz
# Example:    ALL:, .some.domain
#             ALL EXCEPT in.fingerd:, .other.domain
# If you're going to protect the portmapper use the name "portmap" for the
# daemon name. Remember that you can only use the keyword "ALL" and IP
# addresses (NOT host or domain names) for the portmapper. See portmap(8)
# and /usr/doc/portmap/portmapper.txt.gz for further information.
# The PARANOID wildcard matches any host whose name does not match its
# address.
# You may wish to enable this to ensure any programs that don't
# validate looked up hostnames still leave understandable logs. In past
# versions of Debian this has been the default, not sure about Gentoo/Sabayon?

This means that the system with the IP address cannot connect anymore using SSH.

You can specify if/when IP addresses are removed again from /etc/hosts.deny – have a look at the PURGE_DENY variable in /usr/share/denyhosts/denyhosts.cfg. You must start DenyHosts with the –purge option to make the PURGE_DENY variable effective, like this:

# /etc/init.d/denyhosts start –purge

However, you can also remove IP addresses manually from there, and as soon as they have got removed, these IP addresses can try to log in again via SSH.