Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have denyhosts set up and working on Ubuntu 12.04. It apparently works well, except it is too strict.

I can log in from any IP address that I have added to hosts.allow in advance. My sshd_config does not allow password login, only login with keys.

However, logging in from a new IP address with my valid RSA key (which works from my known IP addresses), the server shows this msg in /var/log/auth.log:

Jun 23 19:16:31 MyServerName sshd[5949]: refused connect from hostname.comcast.net (XXX.XXX.XXX.XXX)

In order to connect, all I have to do is add the new IP address to /etc/hosts.allow. That's it. Then I can log in:

Jun 23 19:45:03 MyServerName sshd[6024]: Accepted publickey for username from XXX.XXX.XXX.XXX port 61236 ssh2
Jun 23 19:45:03 MyServerName sshd[6026]: pam_unix(sshd:session): session opened for user username by (uid=0)

I have not changed any of the default denyhosts config values and it works really well -- except that it is too strict.

(Or does something else read /etc/hosts.allow?)

I need to allow any linux user (whose account already exists on the server) to log in from any IP address without making changes on the server in advance (such as adding the IP to hosts.allow).

EightBitTony suggests that denyhosts should allow this behavior. In response to EightBitTony, I changed this question and the title.

share|improve this question
up vote 1 down vote accepted

Denyhosts only blocks failed logins (after a pre-defined count). It doesn't, that I'm aware of, pre-emptively block people.

share|improve this answer
it seems to be doing exactly that. I cannot log in even once unless I first add my IP address to hosts.allow. I'm using RSA keys to log in via SSH. – MountainX Jun 23 '13 at 23:25
I rewrote the question and changed the title based on your response. I accepted your answer as it was helpful. But I still need to figure out why logins are being blocked unless an IP is first added to /etc/hosts.allow. Thx – MountainX Jun 23 '13 at 23:58

You cannot simultaneously block access on the lower level (IP) and demand from the higher level protocol (SSH) to override the block – simply because the higher level is never reached (in case of a block).

You can restrict the login hosts for the users in general and allow just one user to login from everywhere. But that would not be a dynamic solution.

You can also run two sshd instances, one using denyhosts, the other one being usable by this one user only. Unfortunately it seems not to be possible to disable libwrap in the configuration so you would probably have to compile sshd with(out) the respective options or run the second instance in a VM or container.

share|improve this answer

I think I found the problem. My /etc/hosts.deny contains these two lines:

sshd: ALL

Does that look like the problem?

Here is a portion of my /etc/hosts.deny:

# /etc/hosts.deny: list of hosts that are _not_ allowed to access the system.
# Example:    ALL: some.host.name, .some.domain
#             ALL EXCEPT in.fingerd: other.host.name, .other.domain
# The PARANOID wildcard matches any host whose name does not match its
# address.

# You may wish to enable this to ensure any programs that don't
# validate looked up hostnames still leave understandable logs. In past
# versions of Debian this has been the default. 
sshd: ALL 
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.