I have denyhosts set up and working on Ubuntu 12.04. It apparently works well, except it is too strict.

I can log in from any IP address that I have added to hosts.allow in advance. My sshd_config does not allow password login, only login with keys.

However, logging in from a new IP address with my valid RSA key (which works from my known IP addresses), the server shows this msg in /var/log/auth.log:

Jun 23 19:16:31 MyServerName sshd[5949]: refused connect from hostname.comcast.net (XXX.XXX.XXX.XXX)

In order to connect, all I have to do is add the new IP address to /etc/hosts.allow. That's it. Then I can log in:

Jun 23 19:45:03 MyServerName sshd[6024]: Accepted publickey for username from XXX.XXX.XXX.XXX port 61236 ssh2
Jun 23 19:45:03 MyServerName sshd[6026]: pam_unix(sshd:session): session opened for user username by (uid=0)

I have not changed any of the default denyhosts config values and it works really well -- except that it is too strict.

(Or does something else read /etc/hosts.allow?)

I need to allow any linux user (whose account already exists on the server) to log in from any IP address without making changes on the server in advance (such as adding the IP to hosts.allow).

EightBitTony suggests that denyhosts should allow this behavior. In response to EightBitTony, I changed this question and the title.

3 Answers 3


Denyhosts only blocks failed logins (after a pre-defined count). It doesn't, that I'm aware of, pre-emptively block people.

  • it seems to be doing exactly that. I cannot log in even once unless I first add my IP address to hosts.allow. I'm using RSA keys to log in via SSH.
    – MountainX
    Jun 23, 2013 at 23:25
  • I rewrote the question and changed the title based on your response. I accepted your answer as it was helpful. But I still need to figure out why logins are being blocked unless an IP is first added to /etc/hosts.allow. Thx
    – MountainX
    Jun 23, 2013 at 23:58

You cannot simultaneously block access on the lower level (IP) and demand from the higher level protocol (SSH) to override the block – simply because the higher level is never reached (in case of a block).

You can restrict the login hosts for the users in general and allow just one user to login from everywhere. But that would not be a dynamic solution.

You can also run two sshd instances, one using denyhosts, the other one being usable by this one user only. Unfortunately it seems not to be possible to disable libwrap in the configuration so you would probably have to compile sshd with(out) the respective options or run the second instance in a VM or container.


I think I found the problem. My /etc/hosts.deny contains these two lines:

sshd: ALL

Does that look like the problem?

Here is a portion of my /etc/hosts.deny:

# /etc/hosts.deny: list of hosts that are _not_ allowed to access the system.
# Example:    ALL: some.host.name, .some.domain
#             ALL EXCEPT in.fingerd: other.host.name, .other.domain
# The PARANOID wildcard matches any host whose name does not match its
# address.

# You may wish to enable this to ensure any programs that don't
# validate looked up hostnames still leave understandable logs. In past
# versions of Debian this has been the default. 
sshd: ALL 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.