Centos7使用DenyHosts防止ssh暴力破解

缺乏、安全感 2023-01-23 14:53 92阅读 0赞

<table> 
 <tbody> 
  <tr> 
   <td><strong>DenyHosts是用python2.3编写的一个程序，会分析/var/log/secure等文件，当发现同一个ip进行多次ssh登录失败时会将其写入/etc/hosts.dengy文件，达到屏蔽该ip的目的。</strong></td> 
  </tr> 
 </tbody> 
</table>

![Centos7使用DenyHosts防止ssh暴力破解Centos7使用DenyHosts防止ssh暴力破解][Centos7_DenyHosts_ssh_Centos7_DenyHosts_ssh]

**下载DenyHosts包**

[root@localhost ~]# wget http://jaist.dl.sourceforge.net/project/denyhosts/denyhosts/2.6/DenyHosts-2.6.tar.gz

**安装DenyHosts**

[root@localhost ~]# tar xf DenyHosts-2.6.tar.gz
    [root@localhost ~]# cd DenyHosts-2.6
    [root@localhost DenyHosts-2.6]# python setup.py install

**制作配置文件**

[root@localhost DenyHosts-2.6]# cp denyhosts.cfg-dist /etc/denyhosts.cfg
    [root@localhost DenyHosts-2.6]# cp daemon-control-dist daemon-control
    [root@localhost DenyHosts-2.6]# chown root daemon-control
    [root@localhost DenyHosts-2.6]# chmod 700 daemon-control

**修改配置文件**

将daemon-control中的\#DENYHOSTS\_CFG = "/usr/share/denyhosts/denyhosts.cfg"改为 DENYHOSTS\_CFG = "/etc/denyhosts.cfg"  
![Centos7使用DenyHosts防止ssh暴力破解Centos7使用DenyHosts防止ssh暴力破解][Centos7_DenyHosts_ssh_Centos7_DenyHosts_ssh 1]

**启动**

[root@localhost DenyHosts-2.6]# ./daemon-control start（注意相对路径）

**测试另外一台服务器远程连接172.16.1.16**

默认允许五次，测试发现登陆失败五次之后不允许登陆

[root@localhost ~]# ssh abc@172.16.1.16
    abc@172.16.1.16's password: 
    Permission denied, please try again.
    abc@172.16.1.16's password: 
    Permission denied, please try again.
    abc@172.16.1.16's password: 
    Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).
    [root@localhost ~]# 
    [root@localhost ~]# ssh abc@172.16.1.16
    abc@172.16.1.16's password: 
    Permission denied, please try again.
    abc@172.16.1.16's password: 
    Permission denied, please try again.
    abc@172.16.1.16's password: 
    Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).
    [root@localhost ~]# ssh abc@172.16.1.16
    abc@172.16.1.16's password: 
    Permission denied, please try again.
    abc@172.16.1.16's password: 
    Permission denied, please try again.
    abc@172.16.1.16's password: 
    Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).
    [root@localhost ~]# ssh abc@172.16.1.16
    abc@172.16.1.16's password: 
    Permission denied, please try again.
    abc@172.16.1.16's password: 
    Permission denied, please try again.
    abc@172.16.1.16's password: 
    Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).
    [root@localhost ~]# ssh abc@172.16.1.16
    ssh_exchange_identification: read: Connection reset by peer

**查看hosts.deny文件**

登陆连续失败之后就会把ip地址写在hosts.deny文件  
![Centos7使用DenyHosts防止ssh暴力破解Centos7使用DenyHosts防止ssh暴力破解][Centos7_DenyHosts_ssh_Centos7_DenyHosts_ssh 2]

如果要使DenyHosts每次重起后自动启动还需做如下设置：  
\# ln -sf /usr/share/denyhosts/daemon-control /etc/init.d/denyhosts  
\# chkconfig --add denyhosts  
\# chkconfig --level 2345 denyhosts on  
或者执行下面的命令加入开机启动，将会修改/etc/rc.local文件：  
\# echo "/usr/share/denyhosts/daemon-control start" >> /etc/rc.local

DenyHosts配置文件/usr/share/denyhosts/denyhosts.cfg说明：

SECURE\_LOG = /var/log/secure  
\#sshd日志文件，它是根据这个文件来判断的，不同的操作系统，文件名稍有不同。

HOSTS\_DENY = /etc/hosts.deny

[Centos7_DenyHosts_ssh_Centos7_DenyHosts_ssh]: /images/20221004/4589e482eed545e68f5443a399f0fe56.png
[Centos7_DenyHosts_ssh_Centos7_DenyHosts_ssh 1]: /images/20221004/b57c8c6ebbe5484781f20d25c1023f7c.png
[Centos7_DenyHosts_ssh_Centos7_DenyHosts_ssh 2]: /images/20221004/adfd667b007a4be094b3b40520e9bdff.png