Samiksha Jaiswal (Editor)

DenyHosts

Updated on
Share on FacebookTweet on TwitterShare on LinkedInShare on Reddit
Developer(s)  Phil Schwartz
Operating system  Linux, FreeBSD
Written in  Python
Type  Security / HIPS
Stable release  3.1 / 16 September 2015; 16 months ago (2015-09-16)
Repository  github.com/denyhosts/denyhosts

DenyHosts is a log-based intrusion prevention security tool for SSH servers written in Python. It is intended to prevent brute-force attacks on SSH servers by monitoring invalid login attempts in the authentication log and blocking the originating IP addresses. DenyHosts is developed by Phil Schwartz, who is also the developer of Kodos Python Regular Expression Debugger.

Contents

Operation

DenyHosts checks the end of the authentication log for recent failed login attempts. It records information about their originating IP addresses and compares the number of invalid attempts to a user-specified threshold. If there have been too many invalid attempts it assumes a dictionary attack is occurring and prevents the IP address from making any further attempts by adding it to /etc/hosts.deny on the server. DenyHosts 2.0 and above support centralized synchronization, so that repeat offenders are blocked from many computers. The site denyhosts.net gathers statistics from computers running the software.

DenyHosts is restricted to connections using IPv4. It does not work with IPv6.

DenyHosts may be run manually, as a daemon, or as a cron job.

Discoveries

In July 2007, The Register reported that from May until July that year, "compromised computers" at Oracle UK were listed among the ten worst offenders for launching brute force SSH attacks on the Internet, according to public DenyHosts listings. After an investigation, Oracle was able to refute suggestions that any of its computers had been compromised.

Vulnerabilities

Daniel B. Cid wrote a paper showing that DenyHosts, as well the similar programs Fail2ban and BlockHosts, were vulnerable to remote log injection, an attack technique similar to SQL injection, in which a specially crafted user name is used to trigger a block against a site chosen by the attacker. This was fixed in version 2.6.

References

DenyHosts Wikipedia


Similar Topics
Falk Boden
Peter Orávik
Leandro Sena
Topics
 
B
i
Link
H2
L