12

I've been using denyhosts for a while and I noticed my /etc/hosts.deny is getting rather large. Denyhosts adds IPs to /etc/hosts.deny, and my denyhosts is configured to never purge IPs.

$ wc -l /etc/hosts.deny
22149 /etc/hosts.deny

Might this become a problem? I don't really understand how libwrap works. Hopefully it is hashing these entries or something for quick access, but I haven't looked at that code.

I am having some strange networking issues where my SSH connections to a gitosis server are hanging (actually, updates of Symfony2 bundles using bin/vendors install). I'm not really sure how to debug it, so I'm looking for things that might be going wrong with the box, such as resource shortages.

This is on an Ubuntu 10.04.4 LTS server.

Improve this question
2
  • Libwrap doesn't hash at all. It parses the file on each invocation, unfortunately for you.
    – David Schwartz
    Feb 28, 2012 at 23:11
  • denyhosts does have options to purge entries over time. I generally find that after a month or two, a given host generally doesn't try to come back.
    – Zoredache
    Feb 29, 2012 at 0:17

1 Answer 1

Reset to default
14

Yes.

But it shouldn't be much of a slowdown unless you have names instead of IPs in there, have the PARANOID option set, or ident turned on (by asking for username info). And it will only slow down the initial connection, not affect anything once the connection is established and passing data.

You could try time tcpdmatch sshd 1.2.3.4 and time tcpdmatch sshd foo.example.com with the last item set to the hostname or IP of the system you're initiating connections from. That should reproduce most of the timing issues of sshd processing the /etc/hosts.deny file and show you how long it's taking.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .