DenyHosts 阻止SSH暴力攻击

当你的 Linux 服务器暴露在互联网之中，该服务器将会遭到互联网上的扫描软件进行扫描，并试图猜测SSH登录口令。

你会发现，每天会有多条SSH登录失败纪录。那些扫描工具将对你的服务器构成威胁，你必须设置复杂登录口令，并将尝试多次登录失败的IP给阻止掉，让其在一段时间内不能访问该服务器。

用DenyHosts可以阻止试图猜测SSH登录口令，它会分析/var/log/secure等日志文件，当发现同一IP在进行多次SSH密码尝试时就会记录IP到/etc/hosts.deny文件，从而达到自动屏蔽该IP的目的。

一、yum 安装 denyhosts

yum install repe-release denyhosts -y

二、 查看 denyhosts 安装路径:

rpm -ql denyhosts

这边说下几个比较重要的目录

该目录中主要存放计划任务，日志压缩 以及 chkconfig 和 service 启动的文档

/etc/cron.d/denyhosts
/etc/denyhosts.conf
/etc/logrotate.d/denyhosts
/etc/rc.d/init.d/denyhosts
/etc/sysconfig/denyhosts
/usr/bin/denyhosts-control
/usr/bin/denyhosts.py

该目录中主要存放 denyhosts 所拒绝及允许的一些主机信息

/var/lib/denyhosts
/var/lib/denyhosts/allowed-hosts
/var/lib/denyhosts/allowed-warned-hosts
/var/lib/denyhosts/hosts
/var/lib/denyhosts/hosts-restricted
/var/lib/denyhosts/hosts-root
/var/lib/denyhosts/hosts-valid
/var/lib/denyhosts/offset
/var/lib/denyhosts/suspicious-logins
/var/lib/denyhosts/sync-hosts
/var/lib/denyhosts/users-hosts
/var/lib/denyhosts/users-invalid
/var/lib/denyhosts/users-valid
/var/log/denyhosts

cp /etc/denyhosts.conf.bak /etc/denyhosts.conf
  egrep -v "(^$|^#)" /etc/denyhosts.conf.bak>/etc/denyhosts.conf

三，denyhost主配置文件/etc/denyhosts.conf 中的配置参数内容：

       ############ THESE SETTINGS ARE REQUIRED ############
# 系统安全日志文件，主要获取ssh信息
SECURE_LOG = /var/log/secure

# 拒绝写入IP文件 hosts.deny
HOSTS_DENY = /etc/hosts.deny

# #过多久后清除已经禁止的，其中w代表周，d代表天，h代表小时，s代表秒，m代表分钟
PURGE_DENY = 4w

# denyhosts所要阻止的服务名称
BLOCK_SERVICE  = sshd

# 允许无效用户登录失败的次数
DENY_THRESHOLD_INVALID = 3

# 允许普通用户登录失败的次数
DENY_THRESHOLD_VALID = 10

# 允许ROOT用户登录失败的次数
DENY_THRESHOLD_ROOT = 6

# 设定 deny host 写入到该资料夹
DENY_THRESHOLD_RESTRICTED = 1

# 将deny的host或ip纪录到Work_dir中
WORK_DIR = /var/lib/denyhosts

SUSPICIOUS_LOGIN_REPORT_ALLOWED_HOSTS=YES

# 是否做域名反解
HOSTNAME_LOOKUP=YES

# 将DenyHOts启动的pid纪录到LOCK_FILE中，已确保服务正确启动，防止同时启动多个服务
LOCK_FILE = /var/lock/subsys/denyhosts

       ############ THESE SETTINGS ARE OPTIONAL ############
# 管理员Mail地址
ADMIN_EMAIL = root
SMTP_HOST = localhost
SMTP_PORT = 25
SMTP_FROM = DenyHosts <nobody@localhost>
SMTP_SUBJECT = DenyHosts Report from $[HOSTNAME]

# 有效用户登录失败计数归零的时间
AGE_RESET_VALID=5d

# ROOT用户登录失败计数归零的时间
AGE_RESET_ROOT=25d

# 用户的失败登录计数重置为0的时间(/usr/share/denyhosts/restricted-usernames)
AGE_RESET_RESTRICTED=25d

# 无效用户登录失败计数归零的时间
AGE_RESET_INVALID=10d

   ######### THESE SETTINGS ARE SPECIFIC TO DAEMON MODE  ##########
# denyhosts log文件
DAEMON_LOG = /var/log/denyhosts

DAEMON_SLEEP = 30s

# 该项与PURGE_DENY 设置成一样，也是清除hosts.deniedssh 用户的时间
DAEMON_PURGE = 1h

 四，启动 denyhosts 服务并查看状态

[root@test scripts]# /etc/init.d/denyhosts status
denyhosts.py 已停
[root@test scripts]# /etc/init.d/denyhosts start
启动 denyhosts：


五、通过测试 invalid、valid、root 等用户设置不同的ssh连接失败次数，来测试 denyhosts

我们允许 invalid 用户只能失败5次、ROOT 用户失败1次、valid用户失败3次

DENY_THRESHOLD_INVALID = 5
  
DENY_THRESHOLD_VALID = 13
  
DENY_THRESHOLD_ROOT = 1

简单的测试脚本：[root@test scripts]# cat see_denyhosts.sh

echo -n "">/var/log/secure
 tail -f /var/log/secure
 tail -f /etc/hosts.deny

查看 /var/log/secure的日志信息

[root@test scripts]# tail -f /var/log/secure
May  8 15:01:21 test sshd[1764]: Failed password for root from 10.0.0.51 port 47358 ssh2
May  8 15:01:23 test sshd[1764]: Failed password for root from 10.0.0.51 port 47358 ssh2
May  8 15:01:24 test sshd[1764]: Failed password for root from 10.0.0.51 port 47358 ssh2
May  8 15:01:24 test sshd[1765]: Connection closed by 10.0.0.51
May  8 15:01:27 test sshd[1766]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.0.51  user=root
May  8 15:01:28 test sshd[1766]: Failed password for root from 10.0.0.51 port 47360 ssh2
May  8 15:01:33 test sshd[1766]: Failed password for root from 10.0.0.51 port 47360 ssh2
May  8 15:01:37 test sshd[1766]: Failed password for root from 10.0.0.51 port 47360 ssh2
May  8 15:01:37 test sshd[1767]: Connection closed by 10.0.0.51
May  8 15:01:37 test sshd[1766]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.0.51  user=root

/etc/hosts.deny文件的信息：
[root@test scripts]# cat /etc/hosts.deny
#
# hosts.deny    This file contains access rules which are used to
#        deny connections to network services that either use
#        the tcp_wrappers library or that have been
#        started through a tcp_wrappers-enabled xinetd.
#
#        The rules in this file can also be set up in
#        /etc/hosts.allow with a 'deny' option instead.
#
#        See 'man 5 hosts_options' and 'man 5 hosts_access'
#        for information on rule syntax.
#        See 'man tcpd' for information on tcp_wrappers
  rsync:ALL
# DenyHosts: Tue May  8 12:53:47 2018 | sshd: 10.0.0.7

[root@test scripts]# cat /etc/hosts.deny
#
# hosts.deny    This file contains access rules which are used to
#        deny connections to network services that either use
#        the tcp_wrappers library or that have been
#        started through a tcp_wrappers-enabled xinetd.
#
#        The rules in this file can also be set up in
#        /etc/hosts.allow with a 'deny' option instead.
#
#        See 'man 5 hosts_options' and 'man 5 hosts_access'
#        for information on rule syntax.
#        See 'man tcpd' for information on tcp_wrappers
  rsync:ALL
# DenyHosts: Tue May  8 12:53:47 2018 | sshd: 10.0.0.7

sshd: 10.0.0.7 ：表示已经禁止ip为10.0.0.7通过ssh服务连接本地服务器了

[root@web01 ~]# ssh anonymous@10.0.0.100
ssh_exchange_identification: Connection closed by remote host

六、关于清除及添加可信主机记录

如果想删除一个已经禁止的主机IP，可以在/etc/hosts.deny文件中删除被禁的ip，

但做好的做法是以下操作：

1、停止DenyHosts服务：service denyhosts stop

2、在 /etc/hosts.deny 中删除你想取消的主机IP

3、编辑 DenyHosts 工作目录的所有文件 /var/lib/denyhosts，并且删除已被添加的主机信息。

/var/lib/denyhosts/hosts
/var/lib/denyhosts/hosts-restricted
/var/lib/denyhosts/hosts-root
/var/lib/denyhosts/hosts-valid
/var/lib/denyhosts/users-hosts
/var/lib/denyhosts/users-invalid
/var/lib/denyhosts/users-valid

七，关于你不想被denyhosts服务访问禁止登陆的主机

1，添加你想允许的主机IP地址到
/var/lib/denyhosts/allowed-hosts

2，启动DenyHosts服务： service denyhosts start

八，将denyhosts服务加入开机自启动中

[root@test denyhosts]# chkconfig denyhosts on
在/etc/rc.local中加入如下内容：
  /etc/init.d/denyhosts start

说明：denyhosts服务可以防止服务器受到外网的攻击。