Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This may not be a performance issue, but I have something like 110,000 ips blocked in hosts.deny (2 years of denyhosting). Should I ever clear hosts.deny? Does anyone have any experience with what happens when you do so?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

It's safe to remove them. Depending on your version of denyhosts, there may be a provision to purge old entries. You can either zero the files or remove them and restart the daemon.

If you remove the file, it will most-likely be repopulated with the entries from your online /var/log/secure.* - say, the last week or 5 weeks, depending on your daemon config.

I've had older versions of denyhosts slow down considerably as the blocked IP tables grow.

Are you using any of the advanced denyhosts features like the centralized reporting or at least email notification?

share|improve this answer
    
Hmmm, right, I guess the ideal would be to turn on a rotation so that it cleans itself periodically. I'm not using centralized reporting or email notification within denyhosts per se, though I do receive logs of ips that get denied via logwatch emails. –  Kzqai Sep 10 '12 at 15:12
    
Any suggestions for what should I look into to set up deny.hosts rotation? –  Kzqai Sep 10 '12 at 15:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.