Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Currently I am watching the live auth.log and someone is continuously trying the brute force attack for 10 hours.

Its my local server so no need to worry but I want to test.

I have installed denyhosts.

There is already an entry for that IP address in hosts.deny. But still he is trying the attacks from same IP. System is not blocking that.

Firstly I don't know how did that IP address get entered in that file. I didn't enter it, is there any other system script which can do that.

hosts.deny is

sshd: 120.195.108.22
sshd: 95.130.12.64

hosts.allow

ALL:ALL
sshd: ALL

Is there any iptable setting that can override the host.deny file

share|improve this question
1  
I will go home today and will make that 100% , your happiness is more important to me. You helped me a lot :) –  John Sep 8 '10 at 1:46
add comment

1 Answer

up vote 2 down vote accepted

hosts.allow can override hosts.deny. Remove those entries from hosts.allow. See the hosts_access(5) man page for details.

share|improve this answer
    
but i want to accept ALL Connections expect from those in hosts.deny. should i empty my hosts.allow file –  John Sep 8 '10 at 1:45
    
Yes. Anything not in hosts.deny will be allowed by default. –  Ignacio Vazquez-Abrams Sep 8 '10 at 1:54
    
thanks buddy , that hacker is now denied access –  John Sep 8 '10 at 1:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.