DenyHosts - Script to thwart ssh attacks
提供：MDWiki
ログを走査して sshd に対する brute force attack を発見して対策をとるツール。Python に依存しており、sshd が tcp_wrapper をサポートしてコンパイルされていなければならない。
目次 |
インストール
なぜかこれを使ってみようと色々やっているうちに FreeBSD 9.0 RC にしてしまったので、これ以降のページでは 9.0 RC での作業を想定する。なお、Python 2.7 系が入っていないと入れようとするので、本体をインストールするよりもたくさんの時間がかかる。
root@freebsd# cd /usr/ports/security/denyhosts
root@freebsd# cat distinfo
SHA256 (DenyHosts-2.6.tar.gz) = 5190ead13a7238e3ccf328cb3b71b16716e1c73939909a4f3fa6904ba58ddf7d
SIZE (DenyHosts-2.6.tar.gz) = 42667
root@freebsd# cat pkg-descr
DenyHosts is a script intended to be run by *ix system administrators to
help thwart ssh server attacks.
If you've ever looked at your ssh log (/var/log/auth.log ) you may be alarmed
to see how many hackers attempted to gain access to your server.
Denyhosts helps you:
- Parses /var/log/auth.log to find all login attempts
- Can be run from the command line, cron or as a daemon (new in 0.9)
- Records all failed login attempts for the user and offending host
- For each host that exceeds a threshold count, records the evil host
- Keeps track of each non-existent user (eg. sdada) when a login attempt failed.
- Keeps track of each existing user (eg. root) when a login attempt failed.
- Keeps track of each offending host (hosts can be purged )
- Keeps track of suspicious logins
- Keeps track of the file offset, so that you can reparse the same file
- When the log file is rotated, the script will detect it
- Appends /etc/hosts.allow
- Optionally sends an email of newly banned hosts and suspicious logins.
- Resolves IP addresses to hostnames, if you want
WWW: http://denyhosts.sourceforge.net/
root@freebsd# make
===> Vulnerability check disabled, database not found
===> License check disabled, port has not defined LICENSE
===> Extracting for denyhosts-2.6_4
=> SHA256 Checksum OK for DenyHosts-2.6.tar.gz.
===> Patching for denyhosts-2.6_4
===> Applying FreeBSD patches for denyhosts-2.6_4
===> denyhosts-2.6_4 depends on file: /usr/local/bin/python2.7 - not found
===> Verifying install for /usr/local/bin/python2.7 in /usr/ports/lang/python27
===> Vulnerability check disabled, database not found
===> License check disabled, port has not defined LICENSE
===> Found saved configuration for python27-2.7.2_2
===> Extracting for python27-2.7.2_2
=> SHA256 Checksum OK for python/Python-2.7.2.tgz.
===> Patching for python27-2.7.2_2
[...]
====
Note that some of the standard modules are provided as separate
ports since they require extra dependencies:
bsddb databases/py-bsddb
gdbm databases/py-gdbm
sqlite3 databases/py-sqlite3
tkinter x11-toolkits/py-tkinter
Install them as needed.
====
===> Compressing manual pages for python27-2.7.2_2
===> Running ldconfig
/sbin/ldconfig -m /usr/local/lib
===> Registering installation for python27-2.7.2_2
===> SECURITY REPORT:
This port has installed the following files which may act as network
servers and may therefore pose a remote security risk to the system.
/usr/local/lib/python2.7/lib-dynload/_socket.so
If there are vulnerabilities in these programs there may be a security
risk to the system. FreeBSD makes no guarantee about the security of
ports included in the Ports Collection. Please type 'make deinstall'
to deinstall the port if this is a concern.
For more information, and contact details about the security
status of this software, see the following webpage:
http://www.python.org/
===> Returning to build of denyhosts-2.6_4
===> Configuring for denyhosts-2.6_4
running config
===> Building for denyhosts-2.6_4
running build
running build_py
creating build
creating build/lib
creating build/lib/DenyHosts
copying DenyHosts/prefs.py -> build/lib/DenyHosts
copying DenyHosts/report.py -> build/lib/DenyHosts
copying DenyHosts/lockfile.py -> build/lib/DenyHosts
copying DenyHosts/__init__.py -> build/lib/DenyHosts
copying DenyHosts/plugin.py -> build/lib/DenyHosts
copying DenyHosts/denyfileutil.py -> build/lib/DenyHosts
copying DenyHosts/deny_hosts.py -> build/lib/DenyHosts
copying DenyHosts/regex.py -> build/lib/DenyHosts
copying DenyHosts/sync.py -> build/lib/DenyHosts
copying DenyHosts/counter.py -> build/lib/DenyHosts
copying DenyHosts/old-daemon.py -> build/lib/DenyHosts
copying DenyHosts/util.py -> build/lib/DenyHosts
copying DenyHosts/daemon.py -> build/lib/DenyHosts
copying DenyHosts/python_version.py -> build/lib/DenyHosts
copying DenyHosts/allowedhosts.py -> build/lib/DenyHosts
copying DenyHosts/filetracker.py -> build/lib/DenyHosts
copying DenyHosts/loginattempt.py -> build/lib/DenyHosts
copying DenyHosts/restricted.py -> build/lib/DenyHosts
copying DenyHosts/purgecounter.py -> build/lib/DenyHosts
copying DenyHosts/version.py -> build/lib/DenyHosts
copying DenyHosts/constants.py -> build/lib/DenyHosts
running build_scripts
creating build/scripts-2.7
copying and adjusting denyhosts.py -> build/scripts-2.7
changing mode of build/scripts-2.7/denyhosts.py from 644 to 755
root@freebsd# make install clean
===> Installing for denyhosts-2.6_4
===> denyhosts-2.6_4 depends on file: /usr/local/bin/python2.7 - found
===> Generating temporary packing list
===> Checking if security/denyhosts already installed
running install
running build
running build_py
running build_scripts
running install_lib
creating /usr/local/lib/python2.7/site-packages/DenyHosts
copying build/lib/DenyHosts/prefs.py -> /usr/local/lib/python2.7/site-packages/DenyHosts
copying build/lib/DenyHosts/report.py -> /usr/local/lib/python2.7/site-packages/DenyHosts
copying build/lib/DenyHosts/lockfile.py -> /usr/local/lib/python2.7/site-packages/DenyHosts
copying build/lib/DenyHosts/__init__.py -> /usr/local/lib/python2.7/site-packages/DenyHosts
copying build/lib/DenyHosts/plugin.py -> /usr/local/lib/python2.7/site-packages/DenyHosts
copying build/lib/DenyHosts/denyfileutil.py -> /usr/local/lib/python2.7/site-packages/DenyHosts
copying build/lib/DenyHosts/deny_hosts.py -> /usr/local/lib/python2.7/site-packages/DenyHosts
copying build/lib/DenyHosts/regex.py -> /usr/local/lib/python2.7/site-packages/DenyHosts
copying build/lib/DenyHosts/sync.py -> /usr/local/lib/python2.7/site-packages/DenyHosts
copying build/lib/DenyHosts/counter.py -> /usr/local/lib/python2.7/site-packages/DenyHosts
copying build/lib/DenyHosts/old-daemon.py -> /usr/local/lib/python2.7/site-packages/DenyHosts
copying build/lib/DenyHosts/util.py -> /usr/local/lib/python2.7/site-packages/DenyHosts
copying build/lib/DenyHosts/daemon.py -> /usr/local/lib/python2.7/site-packages/DenyHosts
copying build/lib/DenyHosts/python_version.py -> /usr/local/lib/python2.7/site-packages/DenyHosts
copying build/lib/DenyHosts/allowedhosts.py -> /usr/local/lib/python2.7/site-packages/DenyHosts
copying build/lib/DenyHosts/filetracker.py -> /usr/local/lib/python2.7/site-packages/DenyHosts
copying build/lib/DenyHosts/loginattempt.py -> /usr/local/lib/python2.7/site-packages/DenyHosts
copying build/lib/DenyHosts/restricted.py -> /usr/local/lib/python2.7/site-packages/DenyHosts
copying build/lib/DenyHosts/purgecounter.py -> /usr/local/lib/python2.7/site-packages/DenyHosts
copying build/lib/DenyHosts/version.py -> /usr/local/lib/python2.7/site-packages/DenyHosts
copying build/lib/DenyHosts/constants.py -> /usr/local/lib/python2.7/site-packages/DenyHosts
byte-compiling /usr/local/lib/python2.7/site-packages/DenyHosts/prefs.py to prefs.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/DenyHosts/report.py to report.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/DenyHosts/lockfile.py to lockfile.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/DenyHosts/__init__.py to __init__.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/DenyHosts/plugin.py to plugin.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/DenyHosts/denyfileutil.py to denyfileutil.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/DenyHosts/deny_hosts.py to deny_hosts.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/DenyHosts/regex.py to regex.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/DenyHosts/sync.py to sync.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/DenyHosts/counter.py to counter.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/DenyHosts/old-daemon.py to old-daemon.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/DenyHosts/util.py to util.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/DenyHosts/daemon.py to daemon.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/DenyHosts/python_version.py to python_version.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/DenyHosts/allowedhosts.py to allowedhosts.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/DenyHosts/filetracker.py to filetracker.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/DenyHosts/loginattempt.py to loginattempt.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/DenyHosts/restricted.py to restricted.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/DenyHosts/purgecounter.py to purgecounter.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/DenyHosts/version.py to version.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/DenyHosts/constants.py to constants.pyc
writing byte-compilation script '/tmp/tmpdsGvvd.py'
/usr/local/bin/python2.7 -O /tmp/tmpdsGvvd.py
removing /tmp/tmpdsGvvd.py
running install_scripts
copying build/scripts-2.7/denyhosts.py -> /usr/local/bin
changing mode of /usr/local/bin/denyhosts.py to 755
running install_data
creating /usr/local/share/denyhosts
copying denyhosts.cfg-dist -> /usr/local/share/denyhosts
copying setup.py -> /usr/local/share/denyhosts
copying daemon-control-dist -> /usr/local/share/denyhosts
creating /usr/local/share/denyhosts/scripts
copying scripts/restricted_from_invalid.py -> /usr/local/share/denyhosts/scripts
copying scripts/restricted_from_passwd.py -> /usr/local/share/denyhosts/scripts
creating /usr/local/share/denyhosts/plugins
copying plugins/README.contrib -> /usr/local/share/denyhosts/plugins
copying plugins/shorewall_allow.sh -> /usr/local/share/denyhosts/plugins
copying plugins/shorewall_deny.sh -> /usr/local/share/denyhosts/plugins
copying plugins/test_deny.py -> /usr/local/share/denyhosts/plugins
running install_egg_info
Writing /usr/local/lib/python2.7/site-packages/DenyHosts-2.6-py2.7.egg-info
===> Installing rc.d startup script(s)
install -o root -g wheel -m 444 /usr/ports/security/denyhosts/work/DenyHosts-2.6/denyhosts.cfg-dist /usr/local/etc/denyhosts.conf-dist
[ -f /usr/local/etc/denyhosts.conf ] || install -o root -g wheel -m 444\
/usr/ports/security/denyhosts/work/DenyHosts-2.6/denyhosts.cfg-dist /usr/local/etc/denyhosts.conf
install -o root -g wheel -m 444 /usr/ports/security/denyhosts/work/DenyHosts-2.6/CHANGELOG.txt /usr/local/share/doc/denyhosts
install -o root -g wheel -m 444 /usr/ports/security/denyhosts/work/DenyHosts-2.6/LICENSE.txt /usr/local/share/doc/denyhosts
install -o root -g wheel -m 444 /usr/ports/security/denyhosts/work/DenyHosts-2.6/README.txt /usr/local/share/doc/denyhosts
-------------------------------------------------------------------------------
To run denyhosts from startup, add denyhosts_enable="YES"
in your /etc/rc.conf.
Configiration options can be found in /usr/local/etc/denyhosts.conf
-------------------------------------------------------------------------------
In order to proper working of denyhosts
1. edit your /etc/hosts.allow file and add:
sshd : /etc/hosts.deniedssh : deny
sshd : ALL : allow
2. issue the following command if /etc/hosts.deniedssh does not exist yet
touch /etc/hosts.deniedssh
-------------------------------------------------------------------------------
Warning:
syslogd should ideally be run with the -c option; this will ensure that
denyhosts notices multiple repeated login attempts.
To do this, add syslogd_flags="-c" to /etc/rc.conf
-------------------------------------------------------------------------------
===> Registering installation for denyhosts-2.6_4
===> Cleaning for python27-2.7.2_2
===> Cleaning for denyhosts-2.6_4
root@freebsd#
起動
まず、上記のインストールログにあるとおり、/etc/rc.conf に以下の一行を追加する。
denyhosts_enable="YES"
で、inetd を再起動する。
root@freebsd# /etc/rc.d/inetd restart Stopping inetd. Starting inetd. root@freebsd#
設定
man ページもサイトのドキュメントも（FAQを除いて）ないため、/usr/local/etc/denyhosts.conf に書かれている self-contained（にしたかったのだろう）な説明を参考にする。かなり分量がある。
############ THESE SETTINGS ARE REQUIRED ############
########################################################################
#
# SECURE_LOG: the log file that contains sshd logging info
# if you are not sure, grep "sshd:" /var/log/*
SECURE_LOG = /var/log/auth.log
########################################################################
########################################################################
#
# HOSTS_DENY: the file which contains restricted host access information
HOSTS_DENY = /etc/hosts.allow
#######################################################################
########################################################################
#
# PURGE_DENY: removed HOSTS_DENY entries that are older than this time
# when DenyHosts is invoked with the --purge flag
# format is: i[dhwmy]
# Where 'i' is an integer (eg. 7)
# 'm' = minutes
# 'h' = hours
# 'd' = days
# 'w' = weeks
# 'y' = years
#
# never purge:
PURGE_DENY =
#######################################################################
#######################################################################
#
# PURGE_THRESHOLD: defines the maximum times a host will be purged.
# Once this value has been exceeded then this host will not be purged.
# Setting this parameter to 0 (the default) disables this feature.
#PURGE_THRESHOLD = 0
#######################################################################
#######################################################################
#
# BLOCK_SERVICE: the service name that should be blocked in HOSTS_DENY
# man 5 hosts_access for details
# eg. sshd: 127.0.0.1 # will block sshd logins from 127.0.0.1
# To block all services for the offending host:
#BLOCK_SERVICE = ALL
# To block only sshd:
#BLOCK_SERVICE = sshd
# To only record the offending host and nothing else (if using
# an auxilary file to list the hosts). Refer to:
# http://denyhosts.sourceforge.net/faq.html#aux
#BLOCK_SERVICE =
#
#######################################################################
#######################################################################
#
# DENY_THRESHOLD_INVALID: block each host after the number of failed login
# attempts has exceeded this value. This value applies to invalid
# user login attempts (eg. non-existent user accounts)
#
DENY_THRESHOLD_INVALID = 5
#
#######################################################################
#######################################################################
#
# DENY_THRESHOLD_VALID: block each host after the number of failed
# login attempts has exceeded this value. This value applies to valid
# user login attempts (eg. user accounts that exist in /etc/passwd) except
# for the "root" user
#
DENY_THRESHOLD_VALID = 10
#
#######################################################################
#######################################################################
#
# DENY_THRESHOLD_ROOT: block each host after the number of failed
# login attempts has exceeded this value. This value applies to
# "root" user login attempts only.
#
DENY_THRESHOLD_ROOT = 1
#
#######################################################################
#######################################################################
#
# DENY_THRESHOLD_RESTRICTED: block each host after the number of failed
# login attempts has exceeded this value. This value applies to
# usernames that appear in the WORK_DIR/restricted-usernames file only.
#
DENY_THRESHOLD_RESTRICTED = 1
#
#######################################################################
#######################################################################
#
# WORK_DIR: the path that DenyHosts will use for writing data to
# (it will be created if it does not already exist).
#
# Note: it is recommended that you use an absolute pathname
# for this value (eg. /home/foo/denyhosts/data)
#
WORK_DIR = /usr/local/share/denyhosts/data
#
#######################################################################
#######################################################################
#
# SUSPICIOUS_LOGIN_REPORT_ALLOWED_HOSTS
#
# SUSPICIOUS_LOGIN_REPORT_ALLOWED_HOSTS=YES|NO
# If set to YES, if a suspicious login attempt results from an allowed-host
# then it is considered suspicious. If this is NO, then suspicious logins
# from allowed-hosts will not be reported. All suspicious logins from
# ip addresses that are not in allowed-hosts will always be reported.
#
SUSPICIOUS_LOGIN_REPORT_ALLOWED_HOSTS=YES
######################################################################
######################################################################
#
# HOSTNAME_LOOKUP
#
# HOSTNAME_LOOKUP=YES|NO
# If set to YES, for each IP address that is reported by Denyhosts,
# the corresponding hostname will be looked up and reported as well
# (if available).
#
HOSTNAME_LOOKUP=NO
#
######################################################################
######################################################################
#
# LOCK_FILE
#
# LOCK_FILE=/path/denyhosts
# If this file exists when DenyHosts is run, then DenyHosts will exit
# immediately. Otherwise, this file will be created upon invocation
# and deleted upon exit. This ensures that only one instance is
# running at a time.
#
# Redhat/Fedora:
#LOCK_FILE = /var/lock/subsys/denyhosts
#
# Debian (and FreeBSD)
LOCK_FILE = /var/run/denyhosts.pid
#
# Misc
#LOCK_FILE = /tmp/denyhosts.lock
#
######################################################################
############ THESE SETTINGS ARE OPTIONAL ############
#######################################################################
#
# ADMIN_EMAIL: if you would like to receive emails regarding newly
# restricted hosts and suspicious logins, set this address to
# match your email address. If you do not want to receive these reports
# leave this field blank (or run with the --noemail option)
#
# Multiple email addresses can be delimited by a comma, eg:
# ADMIN_EMAIL = foo@bar.com, bar@foo.com, etc@foobar.com
#
ADMIN_EMAIL = system.info@firstbrand.co.jp
#
#######################################################################
#######################################################################
#
# SMTP_HOST and SMTP_PORT: if DenyHosts is configured to email
# reports (see ADMIN_EMAIL) then these settings specify the
# email server address (SMTP_HOST) and the server port (SMTP_PORT)
#
#
SMTP_HOST = localhost
SMTP_PORT = 25
#
#######################################################################
#######################################################################
#
# SMTP_USERNAME and SMTP_PASSWORD: set these parameters if your
# smtp email server requires authentication
#
#SMTP_USERNAME=foo
#SMTP_PASSWORD=bar
#
######################################################################
#######################################################################
#
# SMTP_FROM: you can specify the "From:" address in messages sent
# from DenyHosts when it reports thwarted abuse attempts
#
SMTP_FROM = DenyHosts <admin@bsd.firstbrand.co.jp>
#
#######################################################################
#######################################################################
#
# SMTP_SUBJECT: you can specify the "Subject:" of messages sent
# by DenyHosts when it reports thwarted abuse attempts
SMTP_SUBJECT = DenyHosts Report
#
######################################################################
######################################################################
#
# SMTP_DATE_FORMAT: specifies the format used for the "Date:" header
# when sending email messages.
#
# for possible values for this parameter refer to: man strftime
#
# the default:
#
#SMTP_DATE_FORMAT = %a, %d %b %Y %H:%M:%S %z
#
######################################################################
######################################################################
#
# SYSLOG_REPORT
#
# SYSLOG_REPORT=YES|NO
# If set to yes, when denied hosts are recorded the report data
# will be sent to syslog (syslog must be present on your system).
# The default is: NO
#
#SYSLOG_REPORT=NO
#
#SYSLOG_REPORT=YES
#
######################################################################
######################################################################
#
# ALLOWED_HOSTS_HOSTNAME_LOOKUP
#
# ALLOWED_HOSTS_HOSTNAME_LOOKUP=YES|NO
# If set to YES, for each entry in the WORK_DIR/allowed-hosts file,
# the hostname will be looked up. If your versions of tcp_wrappers
# and sshd sometimes log hostnames in addition to ip addresses
# then you may wish to specify this option.
#
#ALLOWED_HOSTS_HOSTNAME_LOOKUP=NO
#
######################################################################
######################################################################
#
# AGE_RESET_VALID: Specifies the period of time between failed login
# attempts that, when exceeded will result in the failed count for
# this host to be reset to 0. This value applies to login attempts
# to all valid users (those within /etc/passwd) with the
# exception of root. If not defined, this count will never
# be reset.
#
# See the comments in the PURGE_DENY section (above)
# for details on specifying this value or for complete details
# refer to: http://denyhosts.sourceforge.net/faq.html#timespec
#
AGE_RESET_VALID=5d
#
######################################################################
######################################################################
#
# AGE_RESET_ROOT: Specifies the period of time between failed login
# attempts that, when exceeded will result in the failed count for
# this host to be reset to 0. This value applies to all login
# attempts to the "root" user account. If not defined,
# this count will never be reset.
#
# See the comments in the PURGE_DENY section (above)
# for details on specifying this value or for complete details
# refer to: http://denyhosts.sourceforge.net/faq.html#timespec
#
AGE_RESET_ROOT=25d
#
######################################################################
######################################################################
#
# AGE_RESET_RESTRICTED: Specifies the period of time between failed login
# attempts that, when exceeded will result in the failed count for
# this host to be reset to 0. This value applies to all login
# attempts to entries found in the WORK_DIR/restricted-usernames file.
# If not defined, the count will never be reset.
#
# See the comments in the PURGE_DENY section (above)
# for details on specifying this value or for complete details
# refer to: http://denyhosts.sourceforge.net/faq.html#timespec
#
AGE_RESET_RESTRICTED=25d
#
######################################################################
######################################################################
#
# AGE_RESET_INVALID: Specifies the period of time between failed login
# attempts that, when exceeded will result in the failed count for
# this host to be reset to 0. This value applies to login attempts
# made to any invalid username (those that do not appear
# in /etc/passwd). If not defined, count will never be reset.
#
# See the comments in the PURGE_DENY section (above)
# for details on specifying this value or for complete details
# refer to: http://denyhosts.sourceforge.net/faq.html#timespec
#
AGE_RESET_INVALID=10d
#
######################################################################
######################################################################
#
# RESET_ON_SUCCESS: If this parameter is set to "yes" then the
# failed count for the respective ip address will be reset to 0
# if the login is successful.
#
# The default is RESET_ON_SUCCESS = no
#
#RESET_ON_SUCCESS = yes
#
#####################################################################
######################################################################
#
# PLUGIN_DENY: If set, this value should point to an executable
# program that will be invoked when a host is added to the
# HOSTS_DENY file. This executable will be passed the host
# that will be added as it's only argument.
#
#PLUGIN_DENY=/usr/bin/true
#
######################################################################
######################################################################
#
# PLUGIN_PURGE: If set, this value should point to an executable
# program that will be invoked when a host is removed from the
# HOSTS_DENY file. This executable will be passed the host
# that is to be purged as it's only argument.
#
#PLUGIN_PURGE=/usr/bin/true
#
######################################################################
######################################################################
#
# USERDEF_FAILED_ENTRY_REGEX: if set, this value should contain
# a regular expression that can be used to identify additional
# hackers for your particular ssh configuration. This functionality
# extends the built-in regular expressions that DenyHosts uses.
# This parameter can be specified multiple times.
# See this faq entry for more details:
# http://denyhosts.sf.net/faq.html#userdef_regex
#
USERDEF_FAILED_ENTRY_REGEX=[a|A]uthentication error for (?P<invalid>invalid user |illegal user )?(?P<user>.*?) from (::ffff:)?(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
USERDEF_FAILED_ENTRY_REGEX=[a|A]uthentication error for (?P<invalid>invalid user |illegal user )?(?P<user>.*?) from (?P<host>.*)
# sorry no entries for IPv6 address yet :(
#
#
######################################################################
######### THESE SETTINGS ARE SPECIFIC TO DAEMON MODE ##########
#######################################################################
#
# DAEMON_LOG: when DenyHosts is run in daemon mode (--daemon flag)
# this is the logfile that DenyHosts uses to report it's status.
# To disable logging, leave blank. (default is: /var/log/denyhosts)
#
DAEMON_LOG = /var/log/denyhosts
#
# disable logging:
#DAEMON_LOG =
#
######################################################################
#######################################################################
#
# DAEMON_LOG_TIME_FORMAT: when DenyHosts is run in daemon mode
# (--daemon flag) this specifies the timestamp format of
# the DAEMON_LOG messages (default is the ISO8061 format:
# ie. 2005-07-22 10:38:01,745)
#
# for possible values for this parameter refer to: man strftime
#
# Jan 1 13:05:59
#DAEMON_LOG_TIME_FORMAT = %b %d %H:%M:%S
#
# Jan 1 01:05:59
#DAEMON_LOG_TIME_FORMAT = %b %d %I:%M:%S
#
######################################################################
#######################################################################
#
# DAEMON_LOG_MESSAGE_FORMAT: when DenyHosts is run in daemon mode
# (--daemon flag) this specifies the message format of each logged
# entry. By default the following format is used:
#
# %(asctime)s - %(name)-12s: %(levelname)-8s %(message)s
#
# Where the "%(asctime)s" portion is expanded to the format
# defined by DAEMON_LOG_TIME_FORMAT
#
# This string is passed to python's logging.Formatter contstuctor.
# For details on the possible format types please refer to:
# http://docs.python.org/lib/node357.html
#
# This is the default:
#DAEMON_LOG_MESSAGE_FORMAT = %(asctime)s - %(name)-12s: %(levelname)-8s %(message)s
#
#
######################################################################
#######################################################################
#
# DAEMON_SLEEP: when DenyHosts is run in daemon mode (--daemon flag)
# this is the amount of time DenyHosts will sleep between polling
# the SECURE_LOG. See the comments in the PURGE_DENY section (above)
# for details on specifying this value or for complete details
# refer to: http://denyhosts.sourceforge.net/faq.html#timespec
#
#
DAEMON_SLEEP = 30s
#
#######################################################################
#######################################################################
#
# DAEMON_PURGE: How often should DenyHosts, when run in daemon mode,
# run the purge mechanism to expire old entries in HOSTS_DENY
# This has no effect if PURGE_DENY is blank.
#
DAEMON_PURGE = 1h
#
#######################################################################
######### THESE SETTINGS ARE SPECIFIC TO ##########
######### DAEMON SYNCHRONIZATION ##########
#######################################################################
#
# Synchronization mode allows the DenyHosts daemon the ability
# to periodically send and receive denied host data such that
# DenyHosts daemons worldwide can automatically inform one
# another regarding banned hosts. This mode is disabled by
# default, you must uncomment SYNC_SERVER to enable this mode.
#
# for more information, please refer to:
# http:/denyhosts.sourceforge.net/faq.html#sync
#
#######################################################################
#######################################################################
#
# SYNC_SERVER: The central server that communicates with DenyHost
# daemons. Currently, denyhosts.net is the only available server
# however, in the future, it may be possible for organizations to
# install their own server for internal network synchronization
#
# To disable synchronization (the default), do nothing.
#
# To enable synchronization, you must uncomment the following line:
#SYNC_SERVER = http://xmlrpc.denyhosts.net:9911
#
#######################################################################
#######################################################################
#
# SYNC_INTERVAL: the interval of time to perform synchronizations if
# SYNC_SERVER has been uncommented. The default is 1 hour.
#
#SYNC_INTERVAL = 1h
#
#######################################################################
#######################################################################
#
# SYNC_UPLOAD: allow your DenyHosts daemon to transmit hosts that have
# been denied? This option only applies if SYNC_SERVER has
# been uncommented.
# The default is SYNC_UPLOAD = yes
#
#SYNC_UPLOAD = no
#SYNC_UPLOAD = yes
#
#######################################################################
#######################################################################
#
# SYNC_DOWNLOAD: allow your DenyHosts daemon to receive hosts that have
# been denied by others? This option only applies if SYNC_SERVER has
# been uncommented.
# The default is SYNC_DOWNLOAD = yes
#
#SYNC_DOWNLOAD = no
#SYNC_DOWNLOAD = yes
#
#
#
#######################################################################
#######################################################################
#
# SYNC_DOWNLOAD_THRESHOLD: If SYNC_DOWNLOAD is enabled this parameter
# filters the returned hosts to those that have been blocked this many
# times by others. That is, if set to 1, then if a single DenyHosts
# server has denied an ip address then you will receive the denied host.
#
# See also SYNC_DOWNLOAD_RESILIENCY
#
#SYNC_DOWNLOAD_THRESHOLD = 10
#
# The default is SYNC_DOWNLOAD_THRESHOLD = 3
#
#SYNC_DOWNLOAD_THRESHOLD = 3
#
#######################################################################
#######################################################################
#
# SYNC_DOWNLOAD_RESILIENCY: If SYNC_DOWNLOAD is enabled then the
# value specified for this option limits the downloaded data
# to this resiliency period or greater.
#
# Resiliency is defined as the timespan between a hackers first known
# attack and it's most recent attack. Example:
#
# If the centralized denyhosts.net server records an attack at 2 PM
# and then again at 5 PM, specifying a SYNC_DOWNLOAD_RESILIENCY = 4h
# will not download this ip address.
#
# However, if the attacker is recorded again at 6:15 PM then the
# ip address will be downloaded by your DenyHosts instance.
#
# This value is used in conjunction with the SYNC_DOWNLOAD_THRESHOLD
# and only hosts that satisfy both values will be downloaded.
# This value has no effect if SYNC_DOWNLOAD_THRESHOLD = 1
#
# The default is SYNC_DOWNLOAD_RESILIENCY = 5h (5 hours)
#
# Only obtain hackers that have been at it for 2 days or more:
#SYNC_DOWNLOAD_RESILIENCY = 2d
#
# Only obtain hackers that have been at it for 5 hours or more:
#SYNC_DOWNLOAD_RESILIENCY = 5h
#
#######################################################################
参照
リンク
- セキュリティ関連メモ のトップページへ
- メインページへ
