Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Currently I am watching the live auth.log and someone is continuously trying the brute force attack for 10 hours.

Its my local server so no need to worry but I want to test.

I have installed denyhosts.

There is already an entry for that IP address in hosts.deny. But still he is trying the attacks from same IP. System is not blocking that.

Firstly I don't know how did that IP address get entered in that file. I didn't enter it, is there any other system script which can do that.

hosts.deny is



sshd: ALL

Is there any iptable setting that can override the host.deny file

share|improve this question
I will go home today and will make that 100% , your happiness is more important to me. You helped me a lot :) – John Sep 8 '10 at 1:46
up vote 3 down vote accepted

hosts.allow can override hosts.deny. Remove those entries from hosts.allow. See the hosts_access(5) man page for details.

share|improve this answer
but i want to accept ALL Connections expect from those in hosts.deny. should i empty my hosts.allow file – John Sep 8 '10 at 1:45
Yes. Anything not in hosts.deny will be allowed by default. – Ignacio Vazquez-Abrams Sep 8 '10 at 1:54
thanks buddy , that hacker is now denied access – John Sep 8 '10 at 1:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.