Hack The Sec-Leading Resource Of Linux Tutorial: DenyHosts

<div dir="ltr" style="text-align: left;" trbidi="on">
<h1 class="entry-title" style="border: 0px; clear: both; font-family: Lato, sans-serif; line-height: 1.09091; margin: 0px 0px 12px; outline: 0px; padding: 0px; text-transform: uppercase; vertical-align: baseline;">
<span style="color: #990000; font-size: large;"><u>INSTALLING DENYHOSTS ON CENTOS 6</u></span></h1>
<div>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;">DenyHosts is a log-based intrusion prevention security tool for SSH servers written in Python. It is intended to prevent brute-force attacks on SSH servers by monitoring invalid login attempts in the authentication log and blocking the originating IP</span></span></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiD1RySwwFlb3FxDiUgqxzGv0MJKNpmB7PbbCmt6GsNAprT7X521HwYKUyklwj7KG6gSgwJyGiXHKHOzWVFnWC1NWeCnF84-cq_CqVYGbq68YiAwz0tnMS8OKE4kw_ZQge_Q0ZjPKopPGfi/s1600/denyhosts_hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiD1RySwwFlb3FxDiUgqxzGv0MJKNpmB7PbbCmt6GsNAprT7X521HwYKUyklwj7KG6gSgwJyGiXHKHOzWVFnWC1NWeCnF84-cq_CqVYGbq68YiAwz0tnMS8OKE4kw_ZQge_Q0ZjPKopPGfi/s1600/denyhosts_hackthesec.co.in.jpg" /></a></div>
<div>
<span style="color: #333333; font-family: verdana, geneva, sans-serif;"><span style="font-size: 15px; line-height: 26px;"> addresses. DenyHosts is developed by Phil Schwartz, who is also the developer of Kodos Python Regular Expression Debugger.</span></span></div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #0b5394; font-family: verdana, geneva, sans-serif;"><b><u>Install DenyHosts</u></b></span></span></div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: verdana, geneva, sans-serif;">First, <a href="http://www.hackthesec.co.in/2016/01/centos-rhel-scientific-linux-6-enable.html">add the EPEL repository.</a> Then simply install the package from the EPEL repository:</span></span></div>
<div>
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Courier New, Courier, monospace; font-size: large;"><span style="line-height: 15.6px;"># yum install denyhosts</span></span></pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="font-family: verdana, geneva, sans-serif;"><div>
<b><u><span style="color: #0b5394;">Configure DenyHosts</span></u></b></div>
<div style="color: #333333;">
Before starting DenyHosts, configure a white list of IPs that DenyHosts should never block. Again, DenyHosts uses <a href="https://www.centos.org/docs/4/html/rhel-rg-en-4/s1-tcpwrappers-access.html">TCP Wrappers</a>. Hence, edit <b>/etc/hosts.allow</b> and add IPs, entire subnets, etc. For example,</div>
</span></span></div>
<div>
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Courier New, Courier, monospace; font-size: large;"><span style="line-height: 15.6px;">sshd: 12.34.56.78
sshd: 192.168.0.0/255.255.255.0</span></span></pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: verdana, geneva, sans-serif;">Start DenyHosts</span></span></div>
<div>
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Courier New, Courier, monospace; font-size: large;"><span style="line-height: 15.6px;"># service denyhosts start</span></span></pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: verdana, geneva, sans-serif;">Configure the system to start DenyHosts at boot:</span></span></div>
<div>
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><span style="color: white; font-family: Courier New, Courier, monospace; font-size: large;"><span style="line-height: 15.6px;"># chkconfig denyhosts on</span></span></pre>
</div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: verdana, geneva, sans-serif;">Basic things to be aware of:</span></span></div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: verdana, geneva, sans-serif;"><div>
<ul style="text-align: left;">
<li>IPs to white list should be added to <b>/etc/hosts.allow.</b></li>
<li>IPs that DenyHosts blocks will be added to <b>/etc/hosts.deny.</b></li>
<li>The DenyHosts configuration file is<b> /etc/denyhosts.conf.</b></li>
<li>DenyHosts logs everything that it does to <b>/var/log/denyhosts.</b></li>
<li>DenyHosts watches <b>/var/log/secure</b> for SSH login attempts.</li>
<li>If a host is ever added to the block list by mistake, just remove it from <b>/etc/hosts.deny. </b>You can also manually add hosts you want to block.</li>
</ul>
</div>
</span></span></div>
<div>
<span style="background-color: white; font-size: 15px; line-height: 26px;"><span style="color: #333333; font-family: verdana, geneva, sans-serif;">Go through the DenyHosts configuration file (<b>/etc/denyhosts.conf</b>) and tune it to your liking. Be sure to restart DenyHosts (<b>service denyhosts restart</b>) if you change anything.</span></span></div>
</div>

How to install DenyHosts on centos 6

INSTALLING DENYHOSTS ON CENTOS 6 DenyHosts is a log-based intrusion prevention security tool for SSH servers written in Python. It is in...