3

I have been trying to set up my MacOS X Server, which I recently upgraded to Mountain Lion, to use denyhosts as I need to open port 22 to it. denyhosts is set up and adds entries to /etc/hosts.deny so I decided to add my laptops IP to it in order to verify that it actually works but I can still log in and my IP shows up in /private/var/log/system.log. I even rebooted the server once just to be sure there wasn't some service that had to be restarted.

I tried the following entries:

ALL: <my laptop's IP>
sshd: <my laptop's IP>
sshd: 127.0.0.1

My /etc/sshd_config has the following parameters set:

UsePAM yes
UseDNS no

I Googled if deny.hosts has been deprecated in OSX 10.7 or 10.8 but I couldn't find any indications that it has. Any ideas of what is going wrong or if there is an alternative way to achieve the same result?

Yes, a private key would solve this problem but for the time being I would like to stick to using password authentication. I also like the idea of denyhosts actually blocking access to all services running on the server and not just ssh.

3 Answers 3

2

I am also trying to get some information about getting denyhosts to work on Mac OS X Mountain Lion. So far I have not succeeded, but I know where to go next. Not sure I really need it though.

According to http://denyhosts.sourceforge.net/ssh_config.html:

In order to take advantage of DenyHosts, you must ensure that your sshd server has been compiled w/ tcp_wrappers support.

Which seems to not be the case anymore with OS X ML. https://discussions.apple.com/thread/4267535?start=0&tstart=0

This is why hosts.deny is ignored in Mountain Lion.

But I am not sure I want to go through installing libwrap through Mac Ports... Maybe I'll just change the SSH port to something higher to limit the onslaught of failed authentication attempts.

Once you are only accepting public-key authentication with sshd, you are really only losing some barely measurable performance and a bit more disk space through syslog.

3

OS X 10.8 uses pf for the packet filtering. To block incoming traffic from a specific IP, you can add a line like this to /etc/pf.conf:

block in from 221.0.213.154

Then do this to re-load the config file:

pfctl -e -f /etc/pf.conf

I tried this, and it works for me.

0

I have been able to successful block these brute force attacks by using a slightly modified installation of Fail2ban on both Snow Leopard and Mountain Lion. I used this tutorial and some tweaks suggested by Dr. Andy Fragen. If you get stuck anywhere let me know, I would be glad to help out.

1
  • 1
    zosorock, welcome to Server Fault! Could you please transfer the main points from the tutorial and Fragen's blog to your answer? Stack Exchange sites try hard to avoid linkrot to be able to help future generations of users... Feb 11, 2013 at 18:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .