BSD Ports

security/denyhosts 3.1.2_1 DragonFly

Script to thwart ssh and imap attacks

System
DragonFly
Repository
DPorts
Maintainer
[email protected] (as in FreeBSD)
License
GPLv2
Categories
security
Package size
77.3 KiB, 421.7 KiB installed

Description

DenyHosts is a utility developed by Phil Schwartz and maintained by a number of developers which aims to thwart sshd (ssh server) brute force attacks.

If you've ever looked at your ssh log (/var/log/auth.log) you may be alarmed to see how many hackers attempted to gain access to your server. Denyhosts helps you:

  • Parses /var/log/auth.log to find all login attempts
  • Can be run from the command line, cron or as a daemon (new in 0.9)
  • Records all failed login attempts for the user and offending host
  • For each host that exceeds a threshold count, records the evil host
  • Keeps track of each non-existent user (eg. sdada) when a login attempt failed.
  • Keeps track of each existing user (eg. root) when a login attempt failed.
  • Keeps track of each offending host (hosts can be purged)
  • Keeps track of suspicious logins
  • Keeps track of the file offset, so that you can reparse the same file
  • When the log file is rotated, the script will detect it
  • Appends /etc/hosts.allow
  • Optionally sends an email of newly banned hosts and suspicious logins.
  • Resolves IP addresses to hostnames, if you want

In the other systems

SystemPortVersion
DragonFlysecurity/denyhosts3.1.2_1
FreeBSDsecurity/denyhosts3.1.2_1
HardenedBSDsecurity/denyhosts3.1.2_1
GhostBSDsecurity/denyhosts3.1.2_1

Install

Binary package:

pkg install denyhosts-py311

From DPorts:

cd /usr/dports/security/denyhosts && make install clean

Dependencies

Run dependencies 2

No port depends on this one.

Configuration

No options to configure.

Service scripts
none

Message after installing

To run denyhosts from startup, add denyhosts_enable="YES"
in your /etc/rc.conf.
Configiration options can be found in /usr/local/etc/denyhosts.conf

In order to proper working of denyhosts
1. edit your /etc/hosts.allow file and add:
sshd : /etc/hosts.deniedssh : deny
sshd : ALL : allow
2. issue the following command if /etc/hosts.deniedssh does not exist yet
touch /etc/hosts.deniedssh

Warning:

syslogd should ideally be run with the -c option; this will ensure that
denyhosts notices multiple repeated login attempts.

To do this, add syslogd_flags="-c" to /etc/rc.conf