3

I have the following in my /etc/hosts.deny file

#
# hosts.deny    This file describes the names of the hosts which are
#       *not* allowed to use the local INET services, as decided
#       by the '/usr/sbin/tcpd' server.
#
# The portmap line is redundant, but it is left to remind you that
# the new secure portmap uses hosts.deny and hosts.allow.  In particular
# you should know that NFS uses portmap!

ALL:ALL

and this in /etc/hosts.allow

#
# hosts.allow   This file describes the names of the hosts which are
#       allowed to use the local INET services, as decided
#       by the '/usr/sbin/tcpd' server.
#
ALL:xx.xx.xx.xx , xx.xx.xxx.xx , xx.xx.xxx.xxx , xx.x.xxx.xxx , xx.xxx.xxx.xxx

but i am still getting lots of these emails:

Time:     Thu Feb 10 13:39:55 2011 +0000
IP:       202.119.208.220 (CN/China/-)
Failures: 5 (sshd)
Interval: 300 seconds
Blocked:  Permanent Block

Log entries:

Feb 10 13:39:52 ds-103 sshd[12566]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.119.208.220  user=root
Feb 10 13:39:52 ds-103 sshd[12567]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.119.208.220  user=root
Feb 10 13:39:52 ds-103 sshd[12568]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.119.208.220  user=root
Feb 10 13:39:52 ds-103 sshd[12571]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.119.208.220  user=root
Feb 10 13:39:53 ds-103 sshd[12575]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.119.208.220  user=root

whats worse is csf is trying to auto block these ip's when the attempt to get in but although it does put ip's in the csf.deny file they do not get blocked either

So i am trying to block all ip's with /etc/hosts.deny and allow only the ip's i use with /etc/hosts.allow but so far it doesn't seem to work.

right now i'm having to manually block each one with iptables, I would rather it automatically block the hackers in case I was away from a pc or asleep

4
  • Ok, try pasting some of the following output: "cat /var/log/auth.log | grep ssh" Feb 10, 2011 at 15:35
  • Another thing, that sometimes bites me inn Linux some config files, need to end in newline as in empty last line. Feb 10, 2011 at 15:38
  • came out with this "cat: /var/log/auth.log: No such file or directory"
    – Jamie
    Feb 10, 2011 at 15:52
  • libwrap is a very old way of doing things, although it should work. Go for multilayer security and configure iptables too! However you should report the bug to centos, because they may have broken something! Nov 8, 2011 at 4:18

3 Answers 3

1

changed the files to this and it now seems to be working.

will know in a few hours if this solved it or not

#
# hosts.deny    This file describes the names of the hosts which are
#       *not* allowed to use the local INET services, as decided
#       by the '/usr/sbin/tcpd' server.
#
# The portmap line is redundant, but it is left to remind you that
# the new secure portmap uses hosts.deny and hosts.allow.  In particular
# you should know that NFS uses portmap!
ALL: ALL

It seems the colon needs a space after it.

#
# hosts.allow   This file describes the names of the hosts which are
#       allowed to use the local INET services, as decided
#       by the '/usr/sbin/tcpd' server.
ALL: xx.xxx.xx.xx , xx.xxx.xxx.xx , xx.xx.xxx.xxx , xx.x.xxx.xxx , xx.xxx.xxx.xxx
2
  • I'm guessing this worked since you haven't replied back. Can you mark it as the correct answer to get it out of the Unanswered list? And help others looking for the answer to this issue? Nov 9, 2011 at 4:24
  • I had the same problem -- the space is required. To "automatically block the hackers in case [you are] away from a pc or asleep": fail2ban
    – xofer
    Apr 16, 2012 at 18:15
0

try setting for sshd deamon explicitly in /etc/hosts.deny

sshd: ALL

and in /etc/hosts.allow

sshd: .example.com xxx.xxx.xxx.xxx

This always works for me.

6
  • i actually tried that first before ALL, it didn't work either :( for some reason it seems that it is ignoring the deny files of both that and csf.deny
    – Jamie
    Feb 10, 2011 at 15:18
  • 3
    Can you try "# ldd /usr/sbin/sshd | grep libwrap" To see if you have support for tcpwrapers installed Feb 10, 2011 at 15:22
  • i did that and this came out: "libwrap.so.0 => /lib64/libwrap.so.0 (0x00002b43a3d31000)"
    – Jamie
    Feb 10, 2011 at 15:30
  • I also use /etc/hosts.deny and /etc/hosts.allow for sshd, and it works perfect here. Are these files in your system world readable?
    – rems
    Feb 10, 2011 at 15:37
  • yeh they are readable, chmod 644. I used the files on another server before and they worked perfectly, I think this time something must be configured slightly wrong.
    – Jamie
    Feb 10, 2011 at 15:49
0

You could also set AllowUsers to your allowed users and IPs.

What I also do to make my life easier is to start a 2nd sshd for external connections, listening on a port different than the default port 22 for ssh. This way many attempts don't even reach my logs. It does not improve security at all, some scripts may scan all ports an find the real one, but most just scan the default port 22. This way my logfiles don't get full with this noise.

I also use /etc/hosts.deny and /etc/hosts.allow for sshd, and it works perfect here. Are these files in your system world readable?

1
  • yeh they are readable, ill make sure to do all of that aswell, just as soon as i figure out what is causing the files to not work properly
    – Jamie
    Feb 11, 2011 at 8:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .