Linux 安装DenyHost防止ssh被暴力破解

PURGE_DENY 

多久清除屏蔽的IP的记录。

########################################################################

#

# PURGE_DENY: removed HOSTS_DENY entries that are older than this time

#             when DenyHosts is invoked with the --purge flag

#

#      format is: i[dhwmy]

#      Where 'i' is an integer (eg. 7) 

#            'm' = minutes    #分钟

#            'h' = hours      #小时

#            'd' = days       #天

#            'w' = weeks      #周

#            'y' = years      #年

#

# never purge:

PURGE_DENY =              #表示所有条目永远不删除（这里才是实际的设置）

#

# purge entries older than 1 week

#PURGE_DENY = 1w        #表示删除记录超过一周的条目

#

# purge entries older than 5 days

#PURGE_DENY = 5d        #表示删除记录超过5天的条目

#######################################################################

PURGE_THRESHOLD

定义某个host最多被清除几次。 超过PURGE_THRESHOLD值就不会被清理了。

#######################################################################

#

# PURGE_THRESHOLD: defines the maximum times a host will be purged.  

# Once this value has been exceeded then this host will not be purged. 

# Setting this parameter to 0 (the default) disables this feature.

#

# default: a denied host can be purged/re-added indefinitely

#PURGE_THRESHOLD = 0

#

# a denied host will be purged at most 2 times. 

#PURGE_THRESHOLD = 2 

#

#######################################################################

BLOCK_SERVICE   表示阻止的服务名。

    默认为sshd，也可以设置FTP、SMPT等。

#######################################################################

#

# BLOCK_SERVICE: the service name that should be blocked in HOSTS_DENY

# 

# man 5 hosts_access for details

#

# eg.   sshd: 127.0.0.1  # will block sshd logins from 127.0.0.1

#

# To block all services for the offending host:

#BLOCK_SERVICE = ALL

# To block only sshd:

BLOCK_SERVICE  = sshd   #禁止的服务名，当然DenyHost不仅仅用于SSH服务，还可用于SMTP等等。

# To only record the offending host and nothing else (if using

# an auxilary file to list the hosts).  Refer to: 

# http://denyhosts.sourceforge.net/faq.html#aux

#BLOCK_SERVICE =    

#

#######################################################################

DENY_THRESHOLD_INVALID 

允许无效用户登录失败的次数

#######################################################################

#

# DENY_THRESHOLD_INVALID: block each host after the number of failed login 

# attempts has exceeded this value.  This value applies to invalid

# user login attempts (eg. non-existent user accounts)

#

DENY_THRESHOLD_INVALID = 1  #允许无效用户登录失败的次数

#

#######################################################################

DENY_THRESHOLD_VALID

    允许有效（普通用户）用户登陆失败的次数

#######################################################################

#

# DENY_THRESHOLD_VALID: block each host after the number of failed 

# login attempts has exceeded this value.  This value applies to valid

# user login attempts (eg. user accounts that exist in /etc/passwd) except

# for the "root" user

#

DENY_THRESHOLD_VALID = 5 #允许普通用户登陆失败的次数

#

#######################################################################

DENY_THRESHOLD_ROOT

允许root登录失败的次数。

#######################################################################

#

# DENY_THRESHOLD_ROOT: block each host after the number of failed 

# login attempts has exceeded this value.  This value applies to 

# "root" user login attempts only.

#

DENY_THRESHOLD_ROOT = 1  #允许root登陆失败的次数

#

#######################################################################

DENY_THRESHOLD_RESTRICTED 设定DenyHost 写入到该资料夹

#######################################################################

#

# DENY_THRESHOLD_RESTRICTED: block each host after the number of failed 

# login attempts has exceeded this value.  This value applies to 

# usernames that appear in the WORK_DIR/restricted-usernames file only.

#

DENY_THRESHOLD_RESTRICTED = 1

#

#######################################################################

WORK_DIR 

#######################################################################

#

# WORK_DIR: the path that DenyHosts will use for writing data to

# (it will be created if it does not already exist).  

#

# Note: it is recommended that you use an absolute pathname

# for this value (eg. /home/foo/denyhosts/data)

#

WORK_DIR = /usr/share/denyhosts/data

#

#######################################################################

#######################################################################

#

# SUSPICIOUS_LOGIN_REPORT_ALLOWED_HOSTS

#

# SUSPICIOUS_LOGIN_REPORT_ALLOWED_HOSTS=YES|NO

# If set to YES, if a suspicious login attempt results from an allowed-host

# then it is considered suspicious.  If this is NO, then suspicious logins 

# from allowed-hosts will not be reported.  All suspicious logins from 

# ip addresses that are not in allowed-hosts will always be reported.

#

SUSPICIOUS_LOGIN_REPORT_ALLOWED_HOSTS=YES

######################################################################

######################################################################

#

# HOSTNAME_LOOKUP

#

# HOSTNAME_LOOKUP=YES|NO

# If set to YES, for each IP address that is reported by Denyhosts,

# the corresponding hostname will be looked up and reported as well

# (if available).

#

HOSTNAME_LOOKUP=YES

#

######################################################################

DAEMON_PURGE

表示DenyHosts在守护进程模式下运行的频率，运行清除机制清除HOSTS_DENY中的过期的记录

如果PURGE_DENY为空，这没有任何效果。

#######################################################################

#

# DAEMON_PURGE: How often should DenyHosts, when run in daemon mode,

# run the purge mechanism to expire old entries in HOSTS_DENY

# This has no effect if PURGE_DENY is blank.

#

DAEMON_PURGE = 1h

#

#######################################################################

#######################################################################

#

# ADMIN_EMAIL: if you would like to receive emails regarding newly

# restricted hosts and suspicious logins, set this address to 

# match your email address.  If you do not want to receive these reports

# leave this field blank (or run with the --noemail option)

#

# Multiple email addresses can be delimited by a comma, eg:

# ADMIN_EMAIL = foo@bar.com, bar@foo.com, etc@foobar.com

#

ADMIN_EMAIL =konglb@xxxx.com

#

#######################################################################

#######################################################################

#

# SMTP_HOST and SMTP_PORT: if DenyHosts is configured to email 

# reports (see ADMIN_EMAIL) then these settings specify the 

# email server address (SMTP_HOST) and the server port (SMTP_PORT)

# 

#

SMTP_HOST = xxx.xxx.xxx.xxx

SMTP_PORT = 25

#

#######################################################################

#######################################################################

# 

# SMTP_USERNAME and SMTP_PASSWORD: set these parameters if your 

# smtp email server requires authentication

#

#SMTP_USERNAME=foo

#SMTP_PASSWORD=bar

#

######################################################################

#######################################################################

#

# SMTP_FROM: you can specify the "From:" address in messages sent

# from DenyHosts when it reports thwarted abuse attempts

#

SMTP_FROM = xxxx<xxxx@xxxxx.com>

#

#######################################################################

#######################################################################

#

# SMTP_SUBJECT: you can specify the "Subject:" of messages sent

# by DenyHosts when it reports thwarted abuse attempts

SMTP_SUBJECT = DenyHosts Report

#

######################################################################

######################################################################

#

# SMTP_DATE_FORMAT: specifies the format used for the "Date:" header

# when sending email messages.

#

# for possible values for this parameter refer to: man strftime

#

# the default:

#

#SMTP_DATE_FORMAT = %a, %d %b %Y %H:%M:%S %z

#

######################################################################

######################################################################

#

# SYSLOG_REPORT

#

# SYSLOG_REPORT=YES|NO

# If set to yes, when denied hosts are recorded the report data

# will be sent to syslog (syslog must be present on your system).

# The default is: NO

#

#SYSLOG_REPORT=NO

#

#SYSLOG_REPORT=YES

#

######################################################################

[root@mylnx04 ~]# cp /usr/share/denyhosts/daemon-control-dist /usr/share/denyhosts/daemon-control

[root@mylnx04 ~]# chown root /usr/share/denyhosts/daemon-control

[root@mylnx04 ~]# chmod 755 /usr/share/denyhosts/daemon-control

[root@mylnx04 ~]# ln -s /usr/share/denyhosts/daemon-control /etc/init.d/denyhosts

[root@mylnx04 ~]# chkconfig --level 345 denyhosts on

#/sbin/service denyhosts restart

或

#service denyhosts restart

[root@mylnx04 ~]# service denyhosts start

starting DenyHosts: /usr/bin/env python /usr/bin/denyhosts.py --daemon --config=/usr/share/denyhosts/denyhosts.cfg