Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have the following in my /etc/hosts.deny file

#
# hosts.deny    This file describes the names of the hosts which are
#       *not* allowed to use the local INET services, as decided
#       by the '/usr/sbin/tcpd' server.
#
# The portmap line is redundant, but it is left to remind you that
# the new secure portmap uses hosts.deny and hosts.allow.  In particular
# you should know that NFS uses portmap!

ALL:ALL

and this in /etc/hosts.allow

#
# hosts.allow   This file describes the names of the hosts which are
#       allowed to use the local INET services, as decided
#       by the '/usr/sbin/tcpd' server.
#
ALL:xx.xx.xx.xx , xx.xx.xxx.xx , xx.xx.xxx.xxx , xx.x.xxx.xxx , xx.xxx.xxx.xxx

but i am still getting lots of these emails:

Time:     Thu Feb 10 13:39:55 2011 +0000
IP:       202.119.208.220 (CN/China/-)
Failures: 5 (sshd)
Interval: 300 seconds
Blocked:  Permanent Block

Log entries:

Feb 10 13:39:52 ds-103 sshd[12566]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.119.208.220  user=root
Feb 10 13:39:52 ds-103 sshd[12567]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.119.208.220  user=root
Feb 10 13:39:52 ds-103 sshd[12568]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.119.208.220  user=root
Feb 10 13:39:52 ds-103 sshd[12571]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.119.208.220  user=root
Feb 10 13:39:53 ds-103 sshd[12575]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.119.208.220  user=root

whats worse is csf is trying to auto block these ip's when the attempt to get in but although it does put ip's in the csf.deny file they do not get blocked either

So i am trying to block all ip's with /etc/hosts.deny and allow only the ip's i use with /etc/hosts.allow but so far it doesn't seem to work.

right now i'm having to manually block each one with iptables, I would rather it automatically block the hackers in case I was away from a pc or asleep

share|improve this question
    
Ok, try pasting some of the following output: "cat /var/log/auth.log | grep ssh" –  Luka Marinko Feb 10 '11 at 15:35
    
Another thing, that sometimes bites me inn Linux some config files, need to end in newline as in empty last line. –  Luka Marinko Feb 10 '11 at 15:38
    
came out with this "cat: /var/log/auth.log: No such file or directory" –  Jamie Feb 10 '11 at 15:52
    
libwrap is a very old way of doing things, although it should work. Go for multilayer security and configure iptables too! However you should report the bug to centos, because they may have broken something! –  The Unix Janitor Nov 8 '11 at 4:18

3 Answers 3

changed the files to this and it now seems to be working.

will know in a few hours if this solved it or not

#
# hosts.deny    This file describes the names of the hosts which are
#       *not* allowed to use the local INET services, as decided
#       by the '/usr/sbin/tcpd' server.
#
# The portmap line is redundant, but it is left to remind you that
# the new secure portmap uses hosts.deny and hosts.allow.  In particular
# you should know that NFS uses portmap!
ALL: ALL

It seems the colon needs a space after it.

#
# hosts.allow   This file describes the names of the hosts which are
#       allowed to use the local INET services, as decided
#       by the '/usr/sbin/tcpd' server.
ALL: xx.xxx.xx.xx , xx.xxx.xxx.xx , xx.xx.xxx.xxx , xx.x.xxx.xxx , xx.xxx.xxx.xxx
share|improve this answer
    
I'm guessing this worked since you haven't replied back. Can you mark it as the correct answer to get it out of the Unanswered list? And help others looking for the answer to this issue? –  CrackerJack9 Nov 9 '11 at 4:24
    
I had the same problem -- the space is required. To "automatically block the hackers in case [you are] away from a pc or asleep": fail2ban –  xofer Apr 16 '12 at 18:15

try setting for sshd deamon explicitly in /etc/hosts.deny

sshd: ALL

and in /etc/hosts.allow

sshd: .example.com xxx.xxx.xxx.xxx

This always works for me.

share|improve this answer
    
i actually tried that first before ALL, it didn't work either :( for some reason it seems that it is ignoring the deny files of both that and csf.deny –  Jamie Feb 10 '11 at 15:18
3  
Can you try "# ldd /usr/sbin/sshd | grep libwrap" To see if you have support for tcpwrapers installed –  Luka Marinko Feb 10 '11 at 15:22
    
i did that and this came out: "libwrap.so.0 => /lib64/libwrap.so.0 (0x00002b43a3d31000)" –  Jamie Feb 10 '11 at 15:30
    
I also use /etc/hosts.deny and /etc/hosts.allow for sshd, and it works perfect here. Are these files in your system world readable? –  rems Feb 10 '11 at 15:37
    
yeh they are readable, chmod 644. I used the files on another server before and they worked perfectly, I think this time something must be configured slightly wrong. –  Jamie Feb 10 '11 at 15:49

You could also set AllowUsers to your allowed users and IPs.

What I also do to make my life easier is to start a 2nd sshd for external connections, listening on a port different than the default port 22 for ssh. This way many attempts don't even reach my logs. It does not improve security at all, some scripts may scan all ports an find the real one, but most just scan the default port 22. This way my logfiles don't get full with this noise.

I also use /etc/hosts.deny and /etc/hosts.allow for sshd, and it works perfect here. Are these files in your system world readable?

share|improve this answer
    
yeh they are readable, ill make sure to do all of that aswell, just as soon as i figure out what is causing the files to not work properly –  Jamie Feb 11 '11 at 8:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.