I recently noticed in my logwatch emails from a couple of servers that although denyhosts was doing its job for some brute force root ssh login attempts others seem to be ignored and continue to pester SSH with 1000s of attempts per day. I have sshd_config set to PermitRootLogin no so not a great worry, but still a concern...

After a bit of investigation I noticed that logwatch was also warning me of Unmatched Entries for these same IPs that all take the form of:

PAM {X} more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost={SUSP.NET.IP.ADDR}  user=root : {MANY} time(s)

Whereas the IPs that do get banned do not have these entries.

A bit of searching pulled up this exchange on the DenyHosts mailing list from January this year which suggests at least one other person has noted this issue but no solution.

After reading the FAQ top to bottom I looked at the DenyHosts/regex.py thinking I might be able to change a REGEX in the conf file. It seems to me as though the default regexes should already be matching other lines in the log file for the IP that is slipping through denyhosts grasp; and therefore banning it anyway, but that does not seem to be happening.

So before I pull out my Python hat I thought it might be worth posting here to see if someone else has already come across and fixed this issue.

CentOS 6.5
Python 2.6.6-52.el6
EPEL DenyHosts 2.6-20.el6

More investigation is leading me to the fact that the original SF DenyHosts project is unresponsive and has since been forked - Fedora has updated package from the new fork but these have not made their way across to EPEL...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.