I have denyhosts set up and working on Ubuntu 12.04. It apparently works well, except it is too strict.
I can log in from any IP address that I have added to hosts.allow in advance. My sshd_config does not allow password login, only login with keys.
However, logging in from a new IP address with my valid RSA key (which works from my known IP addresses), the server shows this msg in /var/log/auth.log:
Jun 23 19:16:31 MyServerName sshd: refused connect from hostname.comcast.net (XXX.XXX.XXX.XXX)
In order to connect, all I have to do is add the new IP address to /etc/hosts.allow. That's it. Then I can log in:
Jun 23 19:45:03 MyServerName sshd: Accepted publickey for username from XXX.XXX.XXX.XXX port 61236 ssh2
Jun 23 19:45:03 MyServerName sshd: pam_unix(sshd:session): session opened for user username by (uid=0)
I have not changed any of the default denyhosts config values and it works really well -- except that it is too strict.
(Or does something else read /etc/hosts.allow?)
I need to allow any linux user (whose account already exists on the server) to log in from any IP address without making changes on the server in advance (such as adding the IP to hosts.allow).
EightBitTony suggests that denyhosts should allow this behavior. In response to EightBitTony, I changed this question and the title.