Linux Admin Blog

System Administration, Linux, Solaris, Backup, Networking, Security, Mysql, Script, Tips & Tricks

Archive for the ‘Denyhost’ Category

Automated Installation of DenyHost on RedHat/Fedora

Posted by sanjaydalal4u on September 15, 2009

#Script

#!/bin/bash
# This script installs Deny Host on RedHat(RHEL) or Fedora.
################################################################################
# This script comes with no warranty or guarantee. Please review the script
# before you run it to ensure that it will not cause adverse effects on your
# system.
#
# If you have any questions or comments, please e-mail: sanjaydalal4u@gmail.com
################################################################################
sudo echo
if [ -f /etc/init.d/denyhosts ]; then
echo Removing existing init scripts
sudo /etc/init.d/denyhosts stop
sudo rm -rf /etc/init.d/denyhosts
sudo chkconfig –remove denyhosts
echo ‘*********************’
echo
fi
if [ -d /usr/share/denyhosts/ ]; then
echo Removing existing installation
sudo rm -rf /usr/share/denyhosts
echo ‘*********************’
echo
fi
echo Installing ‘python’ and dependencies.
sudo yum -y install python
echo ‘*********************’
echo
cd /root
echo Downloading DenyHost
wget http://downloads.sourceforge.net/project/denyhosts/denyhosts/2.6/DenyHosts-2.6.tar.gz?use_mirror=biznetnetworks
echo ‘*********************’
echo
echo Unpacking DenyHost

#!/bin/bash

# This script installs Deny Host on RedHat(RHEL) or Fedora.

################################################################################

# This script comes with no warranty or guarantee. Please review the script

# before you run it to ensure that it will not cause adverse effects on your

# system.

# If you have any questions or comments, please e-mail: sanjaydalal4u@gmail.com

################################################################################

sudo echo

if [ -f /etc/init.d/denyhosts ]; then

echo Removing existing init scripts

sudo /etc/init.d/denyhosts stop

sudo rm -rf /etc/init.d/denyhosts

sudo chkconfig –remove denyhosts

echo ‘*********************’

echo

fi

if [ -d /usr/share/denyhosts/ ]; then

echo Removing existing installation

sudo rm -rf /usr/share/denyhosts

echo ‘*********************’

echo

fi

echo Installing ‘python’ and dependencies.

sudo yum -y install python

echo ‘*********************’

echo

cd /root

echo Downloading DenyHost

wget http://downloads.sourceforge.net/project/denyhosts/denyhosts/2.6/DenyHosts-2.6.tar.gz?use_mirror=biznetnetworks

echo ‘*********************’

echo

echo Unpacking DenyHost

tar -xzf DenyHosts-2.6.tar.gz
cd /root/DenyHosts-2.6
echo ‘*********************’
echo
echo Installing DenyHost
sudo python setup.py install
echo ‘*********************’
echo
cd /usr/share/denyhosts
echo Configuring DenyHost
sudo cp denyhosts.cfg-dist denyhosts.cfg
sudo sed -i.bak ’s/^\s*\(SECURE_LOG\s*=.*\)$/#\1/’ denyhosts.cfg
sudo sed -i.bak ’s/^\s*#\s*SECURE_LOG\s*=\s*\/var\/log\/secure/SECURE_LOG = \/var\/log\/secure/’ denyhosts.cfg
sudo sed -i.bak ’s/^\s*\(LOCK_FILE\s*=.*\)$/#\1/’ denyhosts.cfg
sudo sed -i.bak ’s/^\s*#\s*LOCK_FILE\s*=\s*\/var\/run\/denyhosts.pid/LOCK_FILE = \/var\/run\/denyhosts.pid/’ denyhosts.cfg
sudo sed -i.bak ’s/^\s*\(BLOCK_SERVICE\s*=.*\)$/#\1/’ denyhosts.cfg
sudo sed -i.bak ’s/^\s*#\s*BLOCK_SERVICE\s*=\s*ALL/BLOCK_SERVICE  = ALL/’ denyhosts.cfg
echo ‘*********************’
echo
echo Configuring executable
sudo cp daemon-control-dist daemon-control
sudo sed -i.bak ’s/^\(\s*DENYHOSTS_BIN\s*=\s\).*$/\1″\/usr\/bin\/denyhosts.py”/’ daemon-control
sudo sed -i.bak ’s/^\(\s*DENYHOSTS_LOCK\s*=\s\).*$/\1″\/var\/run\/denyhosts.pid”/’ daemon-control
sudo sed -i.bak ’s/^\(\s*DENYHOSTS_CFG\s*=\s\).*$/\1″\/usr\/share\/denyhosts\/denyhosts.cfg”/’ daemon-control
sudo chown root daemon-control
sudo chmod 700 daemon-control
echo ‘*********************’
echo
echo Adding ddclient to rc scripts
cd /etc/init.d
sudo ln -s /usr/share/denyhosts/daemon-control denyhosts
sudo chkconfig –add denyhosts
sudo chkconfig –level 35 denyhosts on
echo ‘*********************’
echo

Posted in Denyhost | Leave a Comment »

Block brute force attacks using denyhost

Posted by sanjaydalal4u on April 29, 2009

Issue:

Check your /var/log/auth.log file. In this file you can able to see that some unauthorized user is constantly trying to access your system using brute force attacks. He/she trying to get the access of your system by some scripts which is trying to login with different password. We can block this using simple iptables rule.

Step 1 : Install Denyhost tools in your system.

apt-get install denyhost

Step 2 : Configure /etc/denyhost.conf file based on your requirement

* configure this file to anylize the log file

SECURE_LOG = /var/log/auth.log(default)

DENY_THRESHOLD_INVALID = 3 (will  block each host after the number of failed login)

DENY_THRESHOLD_VALID = 5  (will  block each host after the number of failed login for valid user login attempts)

DENY_THRESHOLD_ROOT = 3 (for root login)

Step 3 : Restat denyhost

#/etc/init.d/denyhost restart

Posted in Denyhost, Security | Leave a Comment »