centos6.0安装denyhosts2.6总结

水深无声 2021-09-19 07:50 239阅读 0赞

当你的linux服务器暴露在互联网之中，该服务器将会遭到互联网上的扫描软件进行扫描，并试图猜测SSH登录口令你会发现，每天会有多条SSH登录失败纪录。那些扫描工具将对你的服务器构成威胁，你必须设置复杂登录口令，并将尝试多次登录失败的IP给阻止掉，让其在一段时间内不能访问该服务器。简单方法也可以修改22端口号.

用DenyHosts可以阻止试图猜测SSH登录口令，它会分析/var/log/secure等日志文件，当发现同一IP在进行多次SSH密码尝试时就会记录IP到/etc/hosts.deny文件，从而达到自动屏蔽该IP的目的。last命令的信息来自/var/log/wtmp,如果对有经验的人可能会删除掉这个。但是还是会留下痕迹，使用nmap命令扫描端口，  
nmap -PO -sS ip,使用lsof命令，停掉一些不必要的服务，多关注漏洞，配置强有力的iptables来保护自己的系统或者尝试使用Chkrootkit应用程序对rootkit的跟踪，尝试AIDE来检查文件系统的完整性。服务器上除了root外，Linux用户越少越好，如果非要添加就添加shell为nologin。

DenyHosts安装

1.下载denyhost官网为： [http://denyhosts.sourceforge.net//][http_denyhosts.sourceforge.net]下载到/usr/src目录中，查询一下系统是否符合要求  
\[root@localhost denyhosts\]\# ldd /usr/sbin/sshd|grep libwrap//查看libwrap动态链接库文件。  
        libwrap.so.0 => /lib/libwrap.so.0 (0x006c8000)

\[root@localhost denyhosts\]\# python -V//查询版本为2.6.5  
Python 2.6.5

2.\[root@localhost DenyHosts-2.6\]\# python setup.py install//安装Denyhost  
running install  
running build  
running build\_py  
creating build  
creating build/lib  
creating build/lib/DenyHosts  
copying DenyHosts/version.py -> build/lib/DenyHosts  
copying DenyHosts/purgecounter.py -> build/lib/DenyHosts  
copying DenyHosts/regex.py -> build/lib/DenyHosts  
copying DenyHosts/restricted.py -> build/lib/DenyHosts  
copying DenyHosts/\_\_init\_\_.py -> build/lib/DenyHosts  
copying DenyHosts/old-daemon.py -> build/lib/DenyHosts  
copying DenyHosts/python\_version.py -> build/lib/DenyHosts  
copying DenyHosts/filetracker.py -> build/lib/DenyHosts  
copying DenyHosts/plugin.py -> build/lib/DenyHosts  
copying DenyHosts/constants.py -> build/lib/DenyHosts  
copying DenyHosts/loginattempt.py -> build/lib/DenyHosts  
copying DenyHosts/prefs.py -> build/lib/DenyHosts  
copying DenyHosts/deny\_hosts.py -> build/lib/DenyHosts  
copying DenyHosts/lockfile.py -> build/lib/DenyHosts  
copying DenyHosts/sync.py -> build/lib/DenyHosts  
copying DenyHosts/allowedhosts.py -> build/lib/DenyHosts  
copying DenyHosts/daemon.py -> build/lib/DenyHosts  
copying DenyHosts/util.py -> build/lib/DenyHosts  
copying DenyHosts/counter.py -> build/lib/DenyHosts  
copying DenyHosts/denyfileutil.py -> build/lib/DenyHosts  
copying DenyHosts/report.py -> build/lib/DenyHosts  
running build\_scripts  
creating build/scripts-2.6  
copying and adjusting denyhosts.py -> build/scripts-2.6  
changing mode of build/scripts-2.6/denyhosts.py from 644 to 755  
running install\_lib  
creating /usr/lib/python2.6/site-packages/DenyHosts  
copying build/lib/DenyHosts/version.py -> /usr/lib/python2.6/site-packages/DenyHosts  
copying build/lib/DenyHosts/purgecounter.py -> /usr/lib/python2.6/site-packages/DenyHosts  
copying build/lib/DenyHosts/regex.py -> /usr/lib/python2.6/site-packages/DenyHosts  
copying build/lib/DenyHosts/restricted.py -> /usr/lib/python2.6/site-packages/DenyHosts  
copying build/lib/DenyHosts/\_\_init\_\_.py -> /usr/lib/python2.6/site-packages/DenyHosts  
copying build/lib/DenyHosts/old-daemon.py -> /usr/lib/python2.6/site-packages/DenyHosts  
copying build/lib/DenyHosts/python\_version.py -> /usr/lib/python2.6/site-packages/DenyHosts  
copying build/lib/DenyHosts/filetracker.py -> /usr/lib/python2.6/site-packages/DenyHosts  
copying build/lib/DenyHosts/plugin.py -> /usr/lib/python2.6/site-packages/DenyHosts  
copying build/lib/DenyHosts/constants.py -> /usr/lib/python2.6/site-packages/DenyHosts  
copying build/lib/DenyHosts/loginattempt.py -> /usr/lib/python2.6/site-packages/DenyHosts  
copying build/lib/DenyHosts/prefs.py -> /usr/lib/python2.6/site-packages/DenyHosts  
copying build/lib/DenyHosts/deny\_hosts.py -> /usr/lib/python2.6/site-packages/DenyHosts  
copying build/lib/DenyHosts/lockfile.py -> /usr/lib/python2.6/site-packages/DenyHosts  
copying build/lib/DenyHosts/sync.py -> /usr/lib/python2.6/site-packages/DenyHosts  
copying build/lib/DenyHosts/allowedhosts.py -> /usr/lib/python2.6/site-packages/DenyHosts  
copying build/lib/DenyHosts/daemon.py -> /usr/lib/python2.6/site-packages/DenyHosts  
copying build/lib/DenyHosts/util.py -> /usr/lib/python2.6/site-packages/DenyHosts  
copying build/lib/DenyHosts/counter.py -> /usr/lib/python2.6/site-packages/DenyHosts  
copying build/lib/DenyHosts/denyfileutil.py -> /usr/lib/python2.6/site-packages/DenyHosts  
copying build/lib/DenyHosts/report.py -> /usr/lib/python2.6/site-packages/DenyHosts  
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/version.py to version.pyc  
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/purgecounter.py to purgecounter.pyc  
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/regex.py to regex.pyc  
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/restricted.py to restricted.pyc  
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/\_\_init\_\_.py to \_\_init\_\_.pyc  
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/old-daemon.py to old-daemon.pyc  
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/python\_version.py to python\_version.pyc  
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/filetracker.py to filetracker.pyc  
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/plugin.py to plugin.pyc  
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/constants.py to constants.pyc  
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/loginattempt.py to loginattempt.pyc  
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/prefs.py to prefs.pyc  
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/deny\_hosts.py to deny\_hosts.pyc  
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/lockfile.py to lockfile.pyc  
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/sync.py to sync.pyc  
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/allowedhosts.py to allowedhosts.pyc  
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/daemon.py to daemon.pyc  
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/util.py to util.pyc  
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/counter.py to counter.pyc  
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/denyfileutil.py to denyfileutil.pyc  
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/report.py to report.pyc  
running install\_scripts  
copying build/scripts-2.6/denyhosts.py -> /usr/bin  
changing mode of /usr/bin/denyhosts.py to 755  
running install\_data  
creating /usr/share/denyhosts//在/usr/share目录创建denyhosts目录  
copying denyhosts.cfg-dist -> /usr/share/denyhosts  
copying setup.py -> /usr/share/denyhosts  
copying daemon-control-dist -> /usr/share/denyhosts  
copying CHANGELOG.txt -> /usr/share/denyhosts  
copying README.txt -> /usr/share/denyhosts  
creating /usr/share/denyhosts/scripts  
copying scripts/restricted\_from\_passwd.py -> /usr/share/denyhosts/scripts  
copying scripts/restricted\_from\_invalid.py -> /usr/share/denyhosts/scripts  
creating /usr/share/denyhosts/plugins  
copying plugins/README.contrib -> /usr/share/denyhosts/plugins  
copying plugins/shorewall\_deny.sh -> /usr/share/denyhosts/plugins  
copying plugins/test\_deny.py -> /usr/share/denyhosts/plugins  
copying plugins/shorewall\_allow.sh -> /usr/share/denyhosts/plugins  
copying LICENSE.txt -> /usr/share/denyhosts  
running install\_egg\_info  
Writing /usr/lib/python2.6/site-packages/DenyHosts-2.6-py2.6.egg-info

3. \[root@localhost ~\]\#cd /usr/share/denyhosts/切换目录进入/usr/share/denyhosts目录

4.\[root@localhost denyhosts\]\# cp denyhosts.cfg.disk denyhosts.cfg//拷贝一份denyhosts.cfg  
DenyHosts参数配置  
SECURE\_LOG = /var/log/secure\#ssh日志文件

HOSTS\_DENY = /etc/hosts.deny \#将阻止IP写入到hosts.deny

PURGE\_DENY =30m\#过多久后清除已阻止IP

BLOCK\_SERVICE  = sshd\#阻止服务名

DENY\_THRESHOLD\_INVALID = 5//允许无效用户（在/etc/passwd未列出）登录失败次数,允许无效用户登录失败的次数.

DENY\_THRESHOLD\_VALID = 10\#允许普通用户登录失败的次数

DENY\_THRESHOLD\_ROOT = 1//允许root登录失败的次数

DENY\_THRESHOLD\_RESTRICTED = 1\#设定 deny host 写入到该资料夹

WORK\_DIR = /usr/share/denyhosts/data \#将deny的host或ip纪录到Work\_dir中

SUSPICIOUS\_LOGIN\_REPORT\_ALLOWED\_HOSTS=YES

HOSTNAME\_LOOKUP=YES \#是否做域名反解

LOCK\_FILE = /var/lock/subsys/denyhosts \#将DenyHOts启动的pid纪录到LOCK\_FILE中，已确保服务正确启动，防止同时启动多个服务。

ADMIN\_EMAIL =  [enjoygoodboy@163.com][enjoygoodboy_163.com]  \#设置管理员邮件地址

SMTP\_HOST = localhost

SMTP\_PORT = 25

SMTP\_FROM = DenyHosts < [nobody@localhost][nobody_localhost]>

SMTP\_SUBJECT = DenyHosts Report

AGE\_RESET\_VALID=5d

AGE\_RESET\_ROOT=25d

AGE\_RESET\_RESTRICTED=25d

AGE\_RESET\_INVALID=10d

DAEMON\_LOG = /var/log/denyhosts\#自己的日志文件

DAEMON\_SLEEP = 30s

DAEMON\_PURGE = 1h\#该项与PURGE\_DENY 设置成一样，也是清除hosts.deniedssh 用户的时间

5.DenyHosts启动文件配置  
\[root@localhost denyhosts\]\# cp daemon-control-dist daemon-control  
\[root@localhost denyhosts\]\# chown root daemon-control  
\[root@localhost denyhosts\]\# chmod 700 daemon-control  
\[root@localhost denyhosts\]\# ll  
total 96  
\-rw-r--r-- 1 root root 16549 Dec  8  2006 CHANGELOG.txt  
\-rwx------ 1 root root  4076 Feb 27 18:38 daemon-control  
\-rwxr-xr-x 1 root root  4076 Apr 22  2006 daemon-control-dist  
drwxr-xr-x 2 root root  4096 Feb 27 18:36 data  
\-rw-r--r-- 1 root root   777 Feb 27 16:44 denyhosts.cfg  
\-rw-r--r-- 1 root root 20830 Aug 20  2006 denyhosts.cfg-dist  
\-rw-r--r-- 1 root root 18009 Dec 17  2005 LICENSE.txt  
drwxr-xr-x 2 root root  4096 Feb 27 16:36 plugins  
\-rw-r--r-- 1 root root  3575 Feb  3  2006 README.txt  
drwxr-xr-x 2 root root  4096 Feb 27 16:36 scripts  
\-rw-r--r-- 1 root root  1522 Apr  5  2006 setup.py

\[root@localhost denyhosts\]\# ./daemon-control     \#DenyHosts命令格式  
Usage: ./daemon-control \{start \[args...\] | stop | restart \[args...\] | status | debug | condrestart \[args...\] \}  
   
For a list of valid args refer to:  
$ denyhosts.py --help  
\[root@localhost denyhosts\]\# ./daemon-control start         \#启动DenyHosts  
starting DenyHosts:    /usr/bin/env python /usr/bin/denyhosts.py --daemon --config=/usr/share/denyhosts/denyhosts.cfg  
如果要使DenyHosts每次重起后自动启动还需做如下设置：  
\[root@localhost denyhosts\]\# ln -s /usr/share/denyhosts/daemon-control /etc/init.d/denyhosts//建立符号链接  
\[root@localhost denyhosts\]\# chkconfig --add denyhosts//增加denyhosts服务进程

\[root@localhost denyhosts\]\# chkconfig  denyhosts on//设置开机启动denyhosts

\[root@localhost denyhosts\]\# chkconfig --list denyhosts  
denyhosts       0:off   1:off   2:on    3:on    4:on    5:on    6:off  
或者修改/etc/rc.local文件：  
\[root@localhost denyhosts\]\# vi /etc/rc.local  
加入下面这条命令  
echo "/usr/share/denyhosts/daemon-control start">>/etc/rc.local

6.\[root@localhost denyhosts\]\# tail -f /var/log/secure   
Feb 27 18:43:10 localhost login: pam\_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost=  user=test  
Feb 27 18:43:12 localhost login: FAILED LOGIN 1 FROM (null) FOR test, Authentication failure  
Feb 27 18:43:15 localhost login: FAILED LOGIN 2 FROM (null) FOR test, Authentication failure  
Feb 27 18:43:21 localhost login: FAILED LOGIN 3 FROM (null) FOR test, Authentication failure  
Feb 27 18:43:26 localhost login: pam\_unix(login:session): session opened for user test by LOGIN(uid=0)  
Feb 27 18:43:26 localhost login: LOGIN ON tty1 BY test  
Feb 27 18:45:32 localhost su: pam\_unix(su:auth): authentication failure; logname=test uid=500 euid=0 tty=tty1 ruser=test rhost=  user=root  
Feb 27 18:45:47 localhost su: pam\_unix(su-l:session): session opened for user root by test(uid=500)  
Feb 27 19:00:03 localhost sshd\[19861\]: Accepted password for root from 192.168.40.41 port 4289 ssh2

本文转自zh888 51CTO博客，原文链接：http://blog.51cto.com/zh888/790707，如需转载请自行联系原作者

[http_denyhosts.sourceforge.net]: http://denyhosts.sourceforge.net//
[enjoygoodboy_163.com]: mailto:enjoygoodboy@163.com
[nobody_localhost]: mailto:nobody@localhost