Prevent that SSH Bruteforce attack with denyhosts under FreeBSD

At some point our machine you receive error to sign by log message to SSHD service. Perhaps our machine by a person has with brute-force SSH method has been added. We may use firewall to prevent SSH brute-force attack, or we can Sshguard, Sshdfilter or denyhosts brute – force block. These tools SSH will automatically block brute-force attack. Here I use denyhosts SSH brute-force on my machine to prevent.

Quickly install denyhosts we can use from our FreeBSD ports.

# CD / usr/ports/security/denyhosts
# make install clean

You need the installation steps provided after the denyhosts installation is complete.I post them here for clarity:

——————————————————————————-
To denyhosts off underway come to run, add Denyhosts_enable = “YES”
in/etc/rc.conf.
Configiration options can be found in /usr/local/etc/denyhosts.conf
——————————————————————————-
In order to function by denyhosts
1. Your /etc/hosts.allow file and add:
Sshd: /etc/hosts.deniedssh: deny
Sshd: ALL: allow
2. the following command if /etc/hosts.deniedssh does not exist
Tap /etc/hosts.deniedssh
——————————————————————————-
Warning:

Syslogd Proxy On RHEL5/CentOS – Everything That You Should Know About [Part 1]” href=”http://www.bolozer.com/squid-proxy-on-rhel5centos-everything-that-you-should-know-about-part-1.html”>should be run in the ideal case, with the option – C; This ensures that
Denyhosts noticed several repeated logon attempts.

To do this, add Syslogd_flags = “-c” in /etc/rc.conf
——————————————————————————-

After you have the instructions above in mind, to complete the installation, to the issue.

“# Echo”Denyhosts_enable =”YES”‘ > /etc/rc.conf
# Echo “Syslogd_flags =”-c “‘ > /etc/rc.conf”

Edit now “/ usr/local/etc/denyhosts.conf” and make sure in it you edit the variables HOSTS_DENY and BLOCK_SERVICE
The two variables set to the values as shown below:

…
HOSTS_DENY = /etc/hosts.deniedssh
BLOCK_SERVICE = sshd
…

Edit now “/ etc/hosts.allow” and these guidelines encompass:

…
Sshd: /etc/hosts.deniedssh: deny
Sshd: ALL: allow
…

When you install with remote FreeBSD machines, to prevent that you locked FreeBSD machines add “If” something wrong, you simply:

Sshd: Yourip: allow

After “sshd: ALL: allow”. Please change “Yourip” with your machine IP, example 192.168.0.2.

This should have completed denyhosts configuration, and we must continue to create the “/ etc/hosts.deniedssh” file.

# Touch /etc/hosts.deniedssh

All required links the denyhosts is service to start Python init script and restart of the syslogd. Continue to denyhosts starts blocking up wrong SSH logins

So let’s restart syslog and start denyhosts

# /etc/rc.d/syslogd restart
# /usr/local/etc/rc.d/denyhosts-start

Now script kiddies breaking some hard time to your server guess your user password with a large words Dictinary, when they try to break would have they will soon add to replenish denyhosts etc/hosts.deny rules are filtered.

It is important to say, as you also from the file denyhosts.conf, include this denyhosts seeing new ips in the file with IP addresses in etc/hosts.deny readds every 30 seconds.