#下载 wget http://fossies.org/unix/privat/DenyHosts-2.6.tar.gz #解压 tar -zxvf DenyHosts-2.6.tar.gz #为了方便改个名 mv DenyHosts-2.6 denyhost #进入目录 cd denyhost #安装python yum install python -y #安装denyhost,脚本 python setup.py install #进入配置目录 cd /usr/share/denyhosts/ #为了方便改变配置文件名称 cp daemon-control-dist daemon-control #修改服务文件名称 cp denyhosts.cfg-dist denyhosts.cfg #提高安全级别,修改权限 chown root daemon-control chmod 700 daemon-control #创建启动服务连接 ln -s /usr/share/denyhosts/daemon-control /etc/init.d/denyhosts #添加启动项 chkconfig --add denyhosts #配置denyhosts.cfg vi denyhosts.cfg
填充以下内容
SECURE_LOG = /var/log/secure #ssh日志文件 HOSTS_DENY = /etc/hosts.deny #将阻止IP写入到hosts.deny PURGE_DENY = 5m #过多久后清除已经禁止的,其中w代表周,d代表天,h代表小时,s代表秒,m代表分钟 BLOCK_SERVICE = sshd #阻止服务名 DENY_THRESHOLD_INVALID = 5 #允许无效用户(在/etc/passwd未列出)登录失败次数,允许无效用户登录失败的次数. DENY_THRESHOLD_VALID = 5 #允许普通用户登录失败的次数 DENY_THRESHOLD_ROOT = 5 #允许root登录失败的次数 DENY_THRESHOLD_RESTRICTED = 1 #设定 deny host 写入到该资料夹 WORK_DIR = /usr/share/denyhosts/data #将deny的host或ip纪录到Work_dir中 SUSPICIOUS_LOGIN_REPORT_ALLOWED_HOSTS = YES HOSTNAME_LOOKUP=YES #是否做域名反解 LOCK_FILE = /var/lock/subsys/denyhosts #将DenyHOts启动的pid纪录到LOCK_FILE中,已确保服务正确启动,防止同时启动多个服务。 ADMIN_EMAIL = denyhosts@163.com #设置管理员邮件地址 SMTP_HOST = localhost SMTP_PORT = 25 SMTP_FROM = DenyHosts SMTP_SUBJECT = DenyHosts Report AGE_RESET_VALID=1d #有效用户登录失败计数归零的时间 AGE_RESET_ROOT=1d #root用户登录失败计数归零的时间 AGE_RESET_RESTRICTED=5d #用户的失败登录计数重置为0的时间(/usr/share/denyhosts/data/restricted-usernames) AGE_RESET_INVALID=10d #无效用户登录失败计数归零的时间 DAEMON_LOG = /var/log/denyhosts #自己的日志文件 DAEMON_SLEEP = 30s DAEMON_PURGE = 5m #该项与PURGE_DENY 设置成一样,也是清除hosts.deniedssh 用户的时间
如果想删除一个已经禁止的主机IP,并加入到允许主机例表,只在 /etc/hosts.deny 删除是没用的。需要进入 /var/lib/denyhosts 目录,进入以下操作:
1、停止DenyHosts服务:
service denyhosts stop
2、在 /etc/hosts.deny 中删除你想取消的主机IP
3、编辑 DenyHosts 工作目录的所有文件,通过
grep 192.168.1.191 /usr/share/denyhosts/data/*
然后一个个删除文件中你想取消的主机IP所在的行:
* /usr/share/denyhosts/data/hosts
* /usr/share/denyhosts/data/hosts-restricted
* /usr/share/denyhosts/data/hosts-root
* /usr/share/denyhosts/data/hosts-valid
* /usr/share/denyhosts/data/users-hosts
4、添加你想允许的主机IP地址到/var/lib/denyhosts/allowed-hosts
vi /usr/share/denyhosts/data/allowed-hostsps
然后逐行输入你的IP
thinkai.net 192.168.1.*
5、启动DenyHosts服务:
service denyhosts start
报错排查
#service denyhost start
starting DenyHosts: /usr/bin/env python /usr/bin/denyhosts.py –daemon
–config=/usr/share/denyhosts/denyhosts.cfg
python: can't open file '/usr/bin/denyhosts.py': [Errno 2] No such file or
directory
cd /usr/share/denyhosts/ vi daemon-control
DENYHOSTS_BIN = "/usr/bin/denyhosts.py"
改为
DENYHOSTS_BIN = "/usr/local/bin/denyhosts.py"
cd /usr/local/lib/python2.7/site-packages/ cp -rp DenyHosts /usr/lib/python2.4/site-packages/ /etc/init.d/denyhosts restart
65 queries in 2.155 seconds |