I've been using denyhosts for a while and I noticed my /etc/hosts.deny is getting rather large. Denyhosts adds IPs to /etc/hosts.deny, and my denyhosts is configured to never purge IPs.

$ wc -l /etc/hosts.deny
22149 /etc/hosts.deny

Might this become a problem? I don't really understand how libwrap works. Hopefully it is hashing these entries or something for quick access, but I haven't looked at that code.

I am having some strange networking issues where my SSH connections to a gitosis server are hanging (actually, updates of Symfony2 bundles using bin/vendors install). I'm not really sure how to debug it, so I'm looking for things that might be going wrong with the box, such as resource shortages.

This is on an Ubuntu 10.04.4 LTS server.

  • Libwrap doesn't hash at all. It parses the file on each invocation, unfortunately for you. – David Schwartz Feb 28 '12 at 23:11
  • denyhosts does have options to purge entries over time. I generally find that after a month or two, a given host generally doesn't try to come back. – Zoredache Feb 29 '12 at 0:17


But it shouldn't be much of a slowdown unless you have names instead of IPs in there, have the PARANOID option set, or ident turned on (by asking for username info). And it will only slow down the initial connection, not affect anything once the connection is established and passing data.

You could try time tcpdmatch sshd and time tcpdmatch sshd foo.example.com with the last item set to the hostname or IP of the system you're initiating connections from. That should reproduce most of the timing issues of sshd processing the /etc/hosts.deny file and show you how long it's taking.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.