使用DenyHosts阻止SSH暴力破解

客官°小女子只卖身不卖艺 2022-08-11 00:52 165阅读 0赞

原贴：http://www.sofee.cn/blog/2006/10/22/51/

## [使用DenyHosts阻止SSH暴力破解][DenyHosts_SSH] ##

[CentOS][], [DenyHosts][], [SSH][]

October 22, 2006 at 23:49:22 · Filed under [CentOS][CentOS 1]

公司服务器每天都会有上千的SSH失败尝试记录，一直不停的扫描，这些人真够无 聊的，没事吃饱了撑着，尽找些软件在那里穷举扫描（幸好服务器密码设置的够长够复杂）。

要一条一条将这些IP阻止显然治标不治本，于是找了个DenyHosts软件来代替的偶的手工活，吼吼:)

DenyHosts是Python语言写的一个程序，它会分析SSHD的日志文件，当发现重复的攻击时就会记录IP到/etc/hosts.deny文件，从而达到自动屏蔽IP的功能。

DenyHosts官方网站为：http://denyhosts.sourceforge.net

以下是安装记录（以CentOS 4.4, DenyHosts 2.5 为例）

# cd /usr/local/src# wget http://mesh.dl.sourceforge.net/sourceforge/denyhosts/DenyHosts-2.5.tar.gz# tar -zxvf DenyHosts-2.5.tar.gz
     
    # cd DenyHosts-2.5
     
    # python setup.py install

默认是安装到/usr/share/denyhosts/目录的。

# cd /usr/share/denyhosts/# cp denyhosts.cfg-dist denyhosts.cfg
     
    # vi denyhosts.cfg

这里根据自己需要进行相应的配置

# cp daemon-control-dist daemon-control# vi daemon-control
     
    DENYHOSTS_BIN   = "/usr/bin/denyhosts.py"
     
    DENYHOSTS_LOCK  = "/var/lock/subsys/denyhosts"
     
    DENYHOSTS_CFG   = "/usr/share/denyhosts/denyhosts.cfg"
     
    # chown root daemon-control
     
    # chmod 700 daemon-control

完了之后执行daemon-contron start就可以了。

# ./daemon-control start

如果要使DenyHosts每次重起后自动启动还需做如下设置：

# cd /etc/init.d# ln -s /usr/share/denyhosts/daemon-control denyhosts
     
    # chkconfig --add denyhosts
     
    # chkconfig --level 2345 denyhosts on

或者修改/etc/rc.local文件：

# vi /etc/rc.local

加入下面这条命令

/usr/share/denyhosts/daemon-control start

**DenyHosts配置文件说明：**

SECURE_LOG = /var/log/secure
     
    #sshd日志文件，它是根据这个文件来判断的，不同的操作系统，文件名稍有不同。
     
    HOSTS_DENY = /etc/hosts.deny
     
    #控制用户登陆的文件
     
    PURGE_DENY = 5m
     
    #过多久后清除已经禁止的
     
    BLOCK_SERVICE  = sshd
     
    #禁止的服务名
     
    DENY_THRESHOLD_INVALID = 1
     
    #允许无效用户失败的次数
     
    DENY_THRESHOLD_VALID = 10
     
    #允许普通用户登陆失败的次数
     
    DENY_THRESHOLD_ROOT = 5
     
    #允许root登陆失败的次数
     
    HOSTNAME_LOOKUP=NO
     
    #是否做域名反解
     
    DAEMON_LOG = /var/log/denyhosts
     
    #DenyHosts的日志文件

[ <script src="http://www.sedo.com/auction/auction\_banner\_e.php?Partnerid=23892"></script> \#banner\_sedo\_data \{color:\#002E5E;font-family: verdana;font-size:11px;font-weight:bold;margin:0 8px 0 6px;\}\#banner\_sedo\_data a\{color:\#002E5E;text-decoration:none;\}\#banner\_sedo\_data a:hover\{color:\#ff0000;\}\#banner\_sedo\_data td\{height:18px;\}.bannerDomain\{text-align:left;border-bottom:1px solid \#002E5E;width:151px;padding:0 3px 0 0;\}.bannerTime\{text-align:right;border-bottom:2px solid \#002E5E;padding:0 10px 0 0;width:62px;\}.bannerPrice\{border-bottom:2px solid \#002E5E;text-align:right;padding:0 0 0 6px;width:58px;\}.bannerCurrency\{text-align:left;border-bottom:2px solid \#002E5E;width: 40px;padding:0 3px 0 2px;\}.bannerBackground\{background:url( http://sedo.co.uk/img/auction/banner//background.gif ) no-repeat;\}][_script src_http_www.sedo.com_auction_auction_banner_e.php_Partnerid_23892_script_ _banner_sedo_data _color_002E5E_font-family_ verdana_font-size_11px_font-weight_bold_margin_0 8px 0 6px_banner_sedo_data a_color_002E5E_text-decoration_none_banner_sedo_data a_hover_color_ff0000_banner_sedo_data td_height_18px_.bannerDomain_text-align_left_border-bottom_1px solid _002E5E_width_151px_padding_0 3px 0 0_.bannerTime_text-align_right_border-bottom_2px solid _002E5E_padding_0 10px 0 0_width_62px_.bannerPrice_border-bottom_2px solid _002E5E_text-align_right_padding_0 0 0 6px_width_58px_.bannerCurrency_text-align_left_border-bottom_2px solid _002E5E_width_ 40px_padding_0 3px 0 2px_.bannerBackground_background_url_ http_sedo.co.uk_img_auction_banner_background.gif _ no-repeat]

<table style="border: medium none; width: 468px;"> 
 <tbody> 
  <tr> 
   <td style="width: 156px; height: 60px;"><a href="http://sedo.co.uk/search/searchresult.php4?language=e&amp;partnerid=23892&amp;listing_type=auctions_only" rel="nofollow"><img style="border: medium none; width: 156px; height: 60px;" src="http://sedo.co.uk/img/auction/banner/auction_sedo_logo_e.gif" alt="Sedo Auctions"></a></td> 
   <td> 
    <table style="border: medium none;"> 
     <tbody> 
      <tr> 
       <td><a href="http://sedo.co.uk/auction/index.php?language=e&amp;partnerid=23892&amp;domain=f0z.com" rel="nofollow">f0z.com</a></td> 
       <td><a href="http://sedo.co.uk/auction/index.php?language=e&amp;partnerid=23892&amp;domain=f0z.com" rel="nofollow">0h&nbsp;24m</a></td> 
       <td><a href="http://sedo.co.uk/auction/index.php?language=e&amp;partnerid=23892&amp;domain=f0z.com" rel="nofollow">132</a></td> 
       <td><a href="http://sedo.co.uk/auction/index.php?language=e&amp;partnerid=23892&amp;domain=f0z.com" rel="nofollow">$US</a></td> 
      </tr> 
      <tr> 
       <td><a href="http://sedo.co.uk/auction/index.php?language=e&amp;partnerid=23892&amp;domain=monetizes.com" rel="nofollow">monetizes.com</a></td> 
       <td><a href="http://sedo.co.uk/auction/index.php?language=e&amp;partnerid=23892&amp;domain=monetizes.com" rel="nofollow">0h&nbsp;55m</a></td> 
       <td><a href="http://sedo.co.uk/auction/index.php?language=e&amp;partnerid=23892&amp;domain=monetizes.com" rel="nofollow">150</a></td> 
       <td><a href="http://sedo.co.uk/auction/index.php?language=e&amp;partnerid=23892&amp;domain=monetizes.com" rel="nofollow">$US</a></td> 
      </tr> 
      <tr> 
       <td><a href="http://sedo.co.uk/auction/index.php?language=e&amp;partnerid=23892&amp;domain=lotbank.com" rel="nofollow">lotbank.com</a></td> 
       <td><a href="http://sedo.co.uk/auction/index.php?language=e&amp;partnerid=23892&amp;domain=lotbank.com" rel="nofollow">3h&nbsp;4m</a></td> 
       <td><a href="http://sedo.co.uk/auction/index.php?language=e&amp;partnerid=23892&amp;domain=lotbank.com" rel="nofollow">400</a></td> 
       <td><a href="http://sedo.co.uk/auction/index.php?language=e&amp;partnerid=23892&amp;domain=lotbank.com" rel="nofollow">$US</a></td> 
      </tr> 
     </tbody> 
    </table> </td> 
  </tr> 
 </tbody> 
</table>

[Permalink][DenyHosts_SSH]

### [Fwolf’s Blog » Blog Archive \[MediaTemple\]虚拟主机内存优化的一点心得 - Fwolf's Blog][Fwolf_s Blog _ Blog Archive _MediaTemple_ - Fwolf_s Blog] said, ###

February 20, 2008 @ [00:34:50][00_34_50]

\[...\] 顺便还把denyhosts装上了，daemon模式运行，占内存不多，攻击者还不少呢，值得。参考：使用DenyHosts阻止SSH暴力破解 \[...\]

[DenyHosts_SSH]: http://www.sofee.cn/blog/2006/10/22/51/
[CentOS]: http://www.sofee.cn/blog/tag/centos/
[DenyHosts]: http://www.sofee.cn/blog/tag/denyhosts/
[SSH]: http://www.sofee.cn/blog/tag/ssh/
[CentOS 1]: http://www.sofee.cn/blog/category/technical/os/centos/
[_script src_http_www.sedo.com_auction_auction_banner_e.php_Partnerid_23892_script_ _banner_sedo_data _color_002E5E_font-family_ verdana_font-size_11px_font-weight_bold_margin_0 8px 0 6px_banner_sedo_data a_color_002E5E_text-decoration_none_banner_sedo_data a_hover_color_ff0000_banner_sedo_data td_height_18px_.bannerDomain_text-align_left_border-bottom_1px solid _002E5E_width_151px_padding_0 3px 0 0_.bannerTime_text-align_right_border-bottom_2px solid _002E5E_padding_0 10px 0 0_width_62px_.bannerPrice_border-bottom_2px solid _002E5E_text-align_right_padding_0 0 0 6px_width_58px_.bannerCurrency_text-align_left_border-bottom_2px solid _002E5E_width_ 40px_padding_0 3px 0 2px_.bannerBackground_background_url_ http_sedo.co.uk_img_auction_banner_background.gif _ no-repeat]: http://www.sedo.com/search/searchresult.php4?language=us&partnerid=23892&listing_type=auctions_only
[Fwolf_s Blog _ Blog Archive _MediaTemple_ - Fwolf_s Blog]: http://www.fwolf.com/blog/post/383
[00_34_50]: http://www.sofee.cn/blog/2006/10/22/51/#comment-340