Ezylinux

After the server go live to the internet. Not over one day, hacker will have to try login to the system with ssh service together with unremitting. If the system does not preventing to allow user root to Login and password is still more easy. In next few days, It’s pretty sure that some hacker can logged of the system.

The basic technics of hackers that use is “brust force”, it’s essentially guessing password from dictionary.

Well, in this article I will introduce method to prevent “brust force” technics by installing the DenyHosts which can block the IP address from who try to guessing password login. The DenyHost reads ssh log file to verify that the IP which is trying to login to the system, if the IP address has login failed in many times it would block the IP address with TCP Wrapper.

Step #1: Enable Rpmforge Repo

Red Hat Enterprise 5 64bit

[root@Ezylinux ~]# rpm -ivh http://apt.sw.be/redhat/el5/en/x86_64/rpmforge/RPMS/rpmforge-release-0.3.6-1.el5.rf.x86_64.rpm

Red Hat Enterprise 5 32bit

[root@Ezylinux ~]# rpm -ivh http://apt.sw.be/redhat/el5/en/i386/rpmforge/RPMS/rpmforge-release-0.3.6-1.el5.rf.i386.rpm

Red Hat Enterprise 6 64bit

[root@Ezylinux ~]# rpm -ivh http://apt.sw.be/redhat/el6/en/x86_64/rpmforge/RPMS/rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm

Red Hat Enterprise 6 32bit

[root@Ezylinux ~]# rpm -ivh http://apt.sw.be/redhat/el6/en/i386/rpmforge/RPMS/rpmforge-release-0.5.2-2.el6.rf.i686.rpm

Step #2: Install Denyhosts

[root@Ezylinux ~]# yum -y install denyhosts

Step #3: Configure Denyhosts

The default configuration file is located at /etc/denyhosts/denyhosts.cfg.

Here is my own sample configuration file for RHEL / CentOS

SECURE_LOG = /var/log/secure
HOSTS_DENY = /etc/hosts.deny
PURGE_DENY = 7d
BLOCK_SERVICE  = sshd
DENY_THRESHOLD_INVALID = 3
DENY_THRESHOLD_VALID = 5
DENY_THRESHOLD_ROOT = 2
DENY_THRESHOLD_RESTRICTED = 1
WORK_DIR = /usr/share/denyhosts/data
SUSPICIOUS_LOGIN_REPORT_ALLOWED_HOSTS=YES
HOSTNAME_LOOKUP=YES
LOCK_FILE = /var/lock/subsys/denyhosts
ADMIN_EMAIL = MyEmail@ezylinux.com
SMTP_HOST = localhost
SMTP_PORT = 25
SMTP_FROM = DenyHosts 
SMTP_SUBJECT = DenyHosts Report
AGE_RESET_VALID=5d
AGE_RESET_ROOT=25d
AGE_RESET_RESTRICTED=25d
AGE_RESET_INVALID=10d
DAEMON_LOG = /var/log/denyhosts
DAEMON_SLEEP = 30s
DAEMON_PURGE = 1h

If you would like to receive emails regarding newly restricted hosts and suspicious logins, set the ADMIN_EMAIL perameter to match your email address. For multiple email addresses can be delimited by a comma, eg:
ADMIN_EMAIL = Email1@ezylinux.com, Mail2@ezylinux.com

Step #4: Turn On Denyhosts

[root@Ezylinux ~]# chkconfig denyhosts on
[root@Ezylinux ~]# /etc/init.d/denyhosts start
starting DenyHosts:    /usr/bin/env python /usr/bin/denyhosts.py --daemon --config=/etc/denyhosts/denyhosts.cfg