當你的linux服務器暴露在互聯網之中，該服務器將會遭到互聯網上的掃描軟件進行騷描，並試圖猜測SSH登錄口令。
你會發現，每天會有多條SSH登錄失敗紀錄。那些掃描工具將對你的服務器構成威脅，你必須設置複雜登錄口令，並將嘗試多次登錄失敗的IP給阻止掉，讓其在一段時間內不能訪問該服務器。
用DenyHosts可以阻止試圖猜測SSH登錄口令，它會分析/var/log/secure等日誌文件，當發現同一IP在進行多次SSH密碼嘗試時就會記錄IP到/etc/hosts.deny文件，從而達到自動屏蔽該IP的目的。
DenyHosts官方網站爲：http://denyhosts.sourceforge.net/
DenyHosts安裝
[root@switch DenyHost]# ls -l
總用量 44
-rw------- 1 root root 42667 8月 5 19:23 DenyHosts-2.6.tar.gz
[root@switch DenyHost]# tar -zxvf DenyHosts-2.6.tar.gz
DenyHosts-2.6/
DenyHosts-2.6/PKG-INFO
DenyHosts-2.6/denyhosts.py
DenyHosts-2.6/denyhosts.cfg-dist
DenyHosts-2.6/setup.py
DenyHosts-2.6/DenyHosts/
DenyHosts-2.6/DenyHosts/prefs.py
DenyHosts-2.6/DenyHosts/report.py
DenyHosts-2.6/DenyHosts/lockfile.py
DenyHosts-2.6/DenyHosts/__init__.py
DenyHosts-2.6/DenyHosts/plugin.py
DenyHosts-2.6/DenyHosts/denyfileutil.py
DenyHosts-2.6/DenyHosts/deny_hosts.py
DenyHosts-2.6/DenyHosts/regex.py
DenyHosts-2.6/DenyHosts/sync.py
DenyHosts-2.6/DenyHosts/counter.py
DenyHosts-2.6/DenyHosts/old-daemon.py
DenyHosts-2.6/DenyHosts/util.py
DenyHosts-2.6/DenyHosts/daemon.py
DenyHosts-2.6/DenyHosts/python_version.py
DenyHosts-2.6/DenyHosts/allowedhosts.py
DenyHosts-2.6/DenyHosts/filetracker.py
DenyHosts-2.6/DenyHosts/loginattempt.py
DenyHosts-2.6/DenyHosts/restricted.py
DenyHosts-2.6/DenyHosts/purgecounter.py
DenyHosts-2.6/DenyHosts/version.py
DenyHosts-2.6/DenyHosts/constants.py
DenyHosts-2.6/CHANGELOG.txt
DenyHosts-2.6/LICENSE.txt
DenyHosts-2.6/daemon-control-dist
DenyHosts-2.6/plugins/
DenyHosts-2.6/plugins/README.contrib
DenyHosts-2.6/plugins/shorewall_allow.sh
DenyHosts-2.6/plugins/shorewall_deny.sh
DenyHosts-2.6/plugins/test_deny.py
DenyHosts-2.6/scripts/
DenyHosts-2.6/scripts/restricted_from_invalid.py
DenyHosts-2.6/scripts/restricted_from_passwd.py
DenyHosts-2.6/README.txt
DenyHosts-2.6/MANIFEST.in
[root@switch DenyHost]# cd DenyHosts-2.6
[root@switch DenyHosts-2.6]# ls
CHANGELOG.txt DenyHosts denyhosts.py MANIFEST.in plugins scripts
daemon-control-dist denyhosts.cfg-dist LICENSE.txt PKG-INFO README.txt setup.py
[root@switch DenyHosts-2.6]# python setup.py install
running install
running build
running build_py
creating build
creating build/lib
creating build/lib/DenyHosts
copying DenyHosts/deny_hosts.py -> build/lib/DenyHosts
copying DenyHosts/denyfileutil.py -> build/lib/DenyHosts
copying DenyHosts/version.py -> build/lib/DenyHosts
copying DenyHosts/__init__.py -> build/lib/DenyHosts
copying DenyHosts/util.py -> build/lib/DenyHosts
copying DenyHosts/constants.py -> build/lib/DenyHosts
copying DenyHosts/restricted.py -> build/lib/DenyHosts
copying DenyHosts/plugin.py -> build/lib/DenyHosts
copying DenyHosts/sync.py -> build/lib/DenyHosts
copying DenyHosts/prefs.py -> build/lib/DenyHosts
copying DenyHosts/report.py -> build/lib/DenyHosts
copying DenyHosts/filetracker.py -> build/lib/DenyHosts
copying DenyHosts/python_version.py -> build/lib/DenyHosts
copying DenyHosts/loginattempt.py -> build/lib/DenyHosts
copying DenyHosts/allowedhosts.py -> build/lib/DenyHosts
copying DenyHosts/regex.py -> build/lib/DenyHosts
copying DenyHosts/purgecounter.py -> build/lib/DenyHosts
copying DenyHosts/old-daemon.py -> build/lib/DenyHosts
copying DenyHosts/daemon.py -> build/lib/DenyHosts
copying DenyHosts/counter.py -> build/lib/DenyHosts
copying DenyHosts/lockfile.py -> build/lib/DenyHosts
running build_scripts
creating build/scripts-2.3
copying and adjusting denyhosts.py -> build/scripts-2.3
changing mode of build/scripts-2.3/denyhosts.py from 644 to 755
running install_lib
creating /usr/lib/python2.3/site-packages/DenyHosts
copying build/lib/DenyHosts/deny_hosts.py -> /usr/lib/python2.3/site-packages/DenyHosts
copying build/lib/DenyHosts/denyfileutil.py -> /usr/lib/python2.3/site-packages/DenyHosts
copying build/lib/DenyHosts/version.py -> /usr/lib/python2.3/site-packages/DenyHosts
copying build/lib/DenyHosts/__init__.py -> /usr/lib/python2.3/site-packages/DenyHosts
copying build/lib/DenyHosts/util.py -> /usr/lib/python2.3/site-packages/DenyHosts
copying build/lib/DenyHosts/constants.py -> /usr/lib/python2.3/site-packages/DenyHosts
copying build/lib/DenyHosts/restricted.py -> /usr/lib/python2.3/site-packages/DenyHosts
copying build/lib/DenyHosts/plugin.py -> /usr/lib/python2.3/site-packages/DenyHosts
copying build/lib/DenyHosts/sync.py -> /usr/lib/python2.3/site-packages/DenyHosts
copying build/lib/DenyHosts/prefs.py -> /usr/lib/python2.3/site-packages/DenyHosts
copying build/lib/DenyHosts/report.py -> /usr/lib/python2.3/site-packages/DenyHosts
copying build/lib/DenyHosts/filetracker.py -> /usr/lib/python2.3/site-packages/DenyHosts
copying build/lib/DenyHosts/python_version.py -> /usr/lib/python2.3/site-packages/DenyHosts
copying build/lib/DenyHosts/loginattempt.py -> /usr/lib/python2.3/site-packages/DenyHosts
copying build/lib/DenyHosts/allowedhosts.py -> /usr/lib/python2.3/site-packages/DenyHosts
copying build/lib/DenyHosts/regex.py -> /usr/lib/python2.3/site-packages/DenyHosts
copying build/lib/DenyHosts/purgecounter.py -> /usr/lib/python2.3/site-packages/DenyHosts
copying build/lib/DenyHosts/old-daemon.py -> /usr/lib/python2.3/site-packages/DenyHosts
copying build/lib/DenyHosts/daemon.py -> /usr/lib/python2.3/site-packages/DenyHosts
copying build/lib/DenyHosts/counter.py -> /usr/lib/python2.3/site-packages/DenyHosts
copying build/lib/DenyHosts/lockfile.py -> /usr/lib/python2.3/site-packages/DenyHosts
byte-compiling /usr/lib/python2.3/site-packages/DenyHosts/deny_hosts.py to deny_hosts.pyc
byte-compiling /usr/lib/python2.3/site-packages/DenyHosts/denyfileutil.py to denyfileutil.pyc
byte-compiling /usr/lib/python2.3/site-packages/DenyHosts/version.py to version.pyc
byte-compiling /usr/lib/python2.3/site-packages/DenyHosts/__init__.py to __init__.pyc
byte-compiling /usr/lib/python2.3/site-packages/DenyHosts/util.py to util.pyc
byte-compiling /usr/lib/python2.3/site-packages/DenyHosts/constants.py to constants.pyc
byte-compiling /usr/lib/python2.3/site-packages/DenyHosts/restricted.py to restricted.pyc
byte-compiling /usr/lib/python2.3/site-packages/DenyHosts/plugin.py to plugin.pyc
byte-compiling /usr/lib/python2.3/site-packages/DenyHosts/sync.py to sync.pyc
byte-compiling /usr/lib/python2.3/site-packages/DenyHosts/prefs.py to prefs.pyc
byte-compiling /usr/lib/python2.3/site-packages/DenyHosts/report.py to report.pyc
byte-compiling /usr/lib/python2.3/site-packages/DenyHosts/filetracker.py to filetracker.pyc
byte-compiling /usr/lib/python2.3/site-packages/DenyHosts/python_version.py to python_version.pyc
byte-compiling /usr/lib/python2.3/site-packages/DenyHosts/loginattempt.py to loginattempt.pyc
byte-compiling /usr/lib/python2.3/site-packages/DenyHosts/allowedhosts.py to allowedhosts.pyc
byte-compiling /usr/lib/python2.3/site-packages/DenyHosts/regex.py to regex.pyc
byte-compiling /usr/lib/python2.3/site-packages/DenyHosts/purgecounter.py to purgecounter.pyc
byte-compiling /usr/lib/python2.3/site-packages/DenyHosts/old-daemon.py to old-daemon.pyc
byte-compiling /usr/lib/python2.3/site-packages/DenyHosts/daemon.py to daemon.pyc
byte-compiling /usr/lib/python2.3/site-packages/DenyHosts/counter.py to counter.pyc
byte-compiling /usr/lib/python2.3/site-packages/DenyHosts/lockfile.py to lockfile.pyc
running install_scripts
copying build/scripts-2.3/denyhosts.py -> /usr/bin
changing mode of /usr/bin/denyhosts.py to 755
running install_data
creating /usr/share/denyhosts
copying denyhosts.cfg-dist -> /usr/share/denyhosts
copying setup.py -> /usr/share/denyhosts
copying daemon-control-dist -> /usr/share/denyhosts
copying CHANGELOG.txt -> /usr/share/denyhosts
copying README.txt -> /usr/share/denyhosts
creating /usr/share/denyhosts/scripts
copying scripts/restricted_from_invalid.py -> /usr/share/denyhosts/scripts
copying scripts/restricted_from_passwd.py -> /usr/share/denyhosts/scripts
creating /usr/share/denyhosts/plugins
copying plugins/test_deny.py -> /usr/share/denyhosts/plugins
copying plugins/README.contrib -> /usr/share/denyhosts/plugins
copying plugins/shorewall_deny.sh -> /usr/share/denyhosts/plugins
copying plugins/shorewall_allow.sh -> /usr/share/denyhosts/plugins
copying LICENSE.txt -> /usr/share/denyhosts
DenyHosts參數配置
[root@switch DenyHosts-2.6]# cd /usr/share/denyhosts/ #DenyHosts默認安裝目錄
[root@switch denyhosts]# cp denyhosts.cfg-dist denyhosts.cfg
[root@switch denyhosts]# vi denyhosts.cfg #DenyHosts配置文件
SECURE_LOG = /var/log/secure #ssh日誌文件
# format is: i[dhwmy]
# Where i is an integer (eg. 7)
# m = minutes
# h = hours
# d = days
# w = weeks
# y = years
#
# never purge:
PURGE_DENY = 50m #過多久後清除已阻止IP
HOSTS_DENY = /etc/hosts.deny #將阻止IP寫入到hosts.deny
BLOCK_SERVICE = sshd #阻止服務名
DENY_THRESHOLD_INVALID = 1 #允許無效用戶登錄失敗的次數
DENY_THRESHOLD_VALID = 10 #允許普通用戶登錄失敗的次數
DENY_THRESHOLD_ROOT = 5 #允許root登錄失敗的次數
WORK_DIR = /usr/local/share/denyhosts/data #將deny的host或ip紀錄到Work_dir中
DENY_THRESHOLD_RESTRICTED = 1 #設定 deny host 寫入到該資料夾
LOCK_FILE = /var/lock/subsys/denyhosts #將DenyHOts啓動的pid紀錄到LOCK_FILE中，已確保服務正確啓動，防止同時啓動多個服務。
HOSTNAME_LOOKUP=NO #是否做域名反解
ADMIN_EMAIL = [email protected] #設置管理員郵件地址
DAEMON_LOG = /var/log/denyhosts #自己的日誌文件
DAEMON_PURGE = 10m #該項與PURGE_DENY 設置成一樣，也是清除hosts.deniedssh 用戶的時間。
DenyHosts啓動文件配置
[root@switch denyhosts]# cp daemon-control-dist daemon-control
[root@switch denyhosts]# chown root daemon-control
[root@switch denyhosts]# chmod 700 daemon-control
[root@switch denyhosts]# ./daemon-control #DenyHosts命令格式
Usage: ./daemon-control {start [args...] | stop | restart [args...] | status | debug | condrestart [args...] }
For a list of valid args refer to:
$ denyhosts.py --help
[root@switch denyhosts]# ./daemon-control start #啓動DenyHosts
starting DenyHosts: /usr/bin/env python /usr/bin/denyhosts.py --daemon --config=/usr/share/denyhosts/denyhosts.cfg
如果要使DenyHosts每次重起後自動啓動還需做如下設置：
[root@switch denyhosts]# ln -s /usr/share/denyhosts/daemon-control /etc/init.d/denyhosts
[root@switch denyhosts]# chkconfig --add denyhosts
[root@switch denyhosts]# chkconfig denyhosts on
[root@switch denyhosts]#chkconfig –level 2345 denyhosts on
或者修改/etc/rc.local文件：
root@switch denyhosts]# vi /etc/rc.local
加入下面這條命令
/usr/share/denyhosts/daemon-control start
[root@switch denyhosts]# tail -f /var/log/secure
Aug 5 19:20:51 switch sshd[5831]: Accepted password for root from ::ffff:192.168.1.31 port 1744 ssh2
Aug 5 19:21:00 switch sshd[5831]: Received disconnect from ::ffff:192.168.1.31: 0:
Aug 5 19:21:02 switch sshd[5865]: Accepted password for root from ::ffff:192.168.1.31 port 1745 ssh2
Aug 5 19:30:25 switch sshd[5865]: Received disconnect from ::ffff:192.168.1.31: 0:
Aug 5 19:33:48 switch sshd[5962]: Failed password for test from ::ffff:192.168.1.31 port 175