用DenyHosts可以阻止试图猜测SSH登录口令,它会分析/var/log/secure等日志文件,当发现同一IP在进行多次SSH密码尝试时就会记录IP到/etc/hosts.deny文件,从而达到自动屏蔽该IP的目的。last命令的信息来自/var/log/wtmp,如果对有经验的人可能会删除掉这个。但是还是会留下痕迹,使用nmap命令扫描端口,
nmap -PO -sS ip,使用lsof命令,停掉一些不必要的服务,多关注漏洞,配置强有力的iptables来保护自己的系统或者尝试使用Chkrootkit应用程序对rootkit的跟踪,尝试AIDE来检查文件系统的完整性。服务器上除了root外,Linux用户越少越好,如果非要添加就添加shell为nologin。
[root@localhost denyhosts]# ldd /usr/sbin/sshd|grep libwrap//查看libwrap动态链接库文件。
libwrap.so.0 => /lib/libwrap.so.0 (0x006c8000)
Python 2.6.5
running install
running build
running build_py
creating build
creating build/lib
creating build/lib/DenyHosts
copying DenyHosts/version.py -> build/lib/DenyHosts
copying DenyHosts/purgecounter.py -> build/lib/DenyHosts
copying DenyHosts/regex.py -> build/lib/DenyHosts
copying DenyHosts/restricted.py -> build/lib/DenyHosts
copying DenyHosts/__init__.py -> build/lib/DenyHosts
copying DenyHosts/old-daemon.py -> build/lib/DenyHosts
copying DenyHosts/python_version.py -> build/lib/DenyHosts
copying DenyHosts/filetracker.py -> build/lib/DenyHosts
copying DenyHosts/plugin.py -> build/lib/DenyHosts
copying DenyHosts/constants.py -> build/lib/DenyHosts
copying DenyHosts/loginattempt.py -> build/lib/DenyHosts
copying DenyHosts/prefs.py -> build/lib/DenyHosts
copying DenyHosts/deny_hosts.py -> build/lib/DenyHosts
copying DenyHosts/lockfile.py -> build/lib/DenyHosts
copying DenyHosts/sync.py -> build/lib/DenyHosts
copying DenyHosts/allowedhosts.py -> build/lib/DenyHosts
copying DenyHosts/daemon.py -> build/lib/DenyHosts
copying DenyHosts/util.py -> build/lib/DenyHosts
copying DenyHosts/counter.py -> build/lib/DenyHosts
copying DenyHosts/denyfileutil.py -> build/lib/DenyHosts
copying DenyHosts/report.py -> build/lib/DenyHosts
running build_scripts
creating build/scripts-2.6
copying and adjusting denyhosts.py -> build/scripts-2.6
changing mode of build/scripts-2.6/denyhosts.py from 644 to 755
running install_lib
creating /usr/lib/python2.6/site-packages/DenyHosts
copying build/lib/DenyHosts/version.py -> /usr/lib/python2.6/site-packages/DenyHosts
copying build/lib/DenyHosts/purgecounter.py -> /usr/lib/python2.6/site-packages/DenyHosts
copying build/lib/DenyHosts/regex.py -> /usr/lib/python2.6/site-packages/DenyHosts
copying build/lib/DenyHosts/restricted.py -> /usr/lib/python2.6/site-packages/DenyHosts
copying build/lib/DenyHosts/__init__.py -> /usr/lib/python2.6/site-packages/DenyHosts
copying build/lib/DenyHosts/old-daemon.py -> /usr/lib/python2.6/site-packages/DenyHosts
copying build/lib/DenyHosts/python_version.py -> /usr/lib/python2.6/site-packages/DenyHosts
copying build/lib/DenyHosts/filetracker.py -> /usr/lib/python2.6/site-packages/DenyHosts
copying build/lib/DenyHosts/plugin.py -> /usr/lib/python2.6/site-packages/DenyHosts
copying build/lib/DenyHosts/constants.py -> /usr/lib/python2.6/site-packages/DenyHosts
copying build/lib/DenyHosts/loginattempt.py -> /usr/lib/python2.6/site-packages/DenyHosts
copying build/lib/DenyHosts/prefs.py -> /usr/lib/python2.6/site-packages/DenyHosts
copying build/lib/DenyHosts/deny_hosts.py -> /usr/lib/python2.6/site-packages/DenyHosts
copying build/lib/DenyHosts/lockfile.py -> /usr/lib/python2.6/site-packages/DenyHosts
copying build/lib/DenyHosts/sync.py -> /usr/lib/python2.6/site-packages/DenyHosts
copying build/lib/DenyHosts/allowedhosts.py -> /usr/lib/python2.6/site-packages/DenyHosts
copying build/lib/DenyHosts/daemon.py -> /usr/lib/python2.6/site-packages/DenyHosts
copying build/lib/DenyHosts/util.py -> /usr/lib/python2.6/site-packages/DenyHosts
copying build/lib/DenyHosts/counter.py -> /usr/lib/python2.6/site-packages/DenyHosts
copying build/lib/DenyHosts/denyfileutil.py -> /usr/lib/python2.6/site-packages/DenyHosts
copying build/lib/DenyHosts/report.py -> /usr/lib/python2.6/site-packages/DenyHosts
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/version.py to version.pyc
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/purgecounter.py to purgecounter.pyc
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/regex.py to regex.pyc
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/restricted.py to restricted.pyc
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/__init__.py to __init__.pyc
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/old-daemon.py to old-daemon.pyc
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/python_version.py to python_version.pyc
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/filetracker.py to filetracker.pyc
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/plugin.py to plugin.pyc
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/constants.py to constants.pyc
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/loginattempt.py to loginattempt.pyc
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/prefs.py to prefs.pyc
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/deny_hosts.py to deny_hosts.pyc
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/lockfile.py to lockfile.pyc
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/sync.py to sync.pyc
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/allowedhosts.py to allowedhosts.pyc
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/daemon.py to daemon.pyc
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/util.py to util.pyc
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/counter.py to counter.pyc
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/denyfileutil.py to denyfileutil.pyc
byte-compiling /usr/lib/python2.6/site-packages/DenyHosts/report.py to report.pyc
running install_scripts
copying build/scripts-2.6/denyhosts.py -> /usr/bin
changing mode of /usr/bin/denyhosts.py to 755
running install_data
creating /usr/share/denyhosts//在/usr/share目录创建denyhosts目录
copying denyhosts.cfg-dist -> /usr/share/denyhosts
copying setup.py -> /usr/share/denyhosts
copying daemon-control-dist -> /usr/share/denyhosts
copying CHANGELOG.txt -> /usr/share/denyhosts
copying README.txt -> /usr/share/denyhosts
creating /usr/share/denyhosts/scripts
copying scripts/restricted_from_passwd.py -> /usr/share/denyhosts/scripts
copying scripts/restricted_from_invalid.py -> /usr/share/denyhosts/scripts
creating /usr/share/denyhosts/plugins
copying plugins/README.contrib -> /usr/share/denyhosts/plugins
copying plugins/shorewall_deny.sh -> /usr/share/denyhosts/plugins
copying plugins/test_deny.py -> /usr/share/denyhosts/plugins
copying plugins/shorewall_allow.sh -> /usr/share/denyhosts/plugins
copying LICENSE.txt -> /usr/share/denyhosts
running install_egg_info
Writing /usr/lib/python2.6/site-packages/DenyHosts-2.6-py2.6.egg-info
3. [root@localhost ~]#cd /usr/share/denyhosts/切换目录进入/usr/share/denyhosts目录
DenyHosts参数配置
SECURE_LOG = /var/log/secure#ssh日志文件
[root@localhost denyhosts]# cp daemon-control-dist daemon-control
[root@localhost denyhosts]# chown root daemon-control
[root@localhost denyhosts]# chmod 700 daemon-control
[root@localhost denyhosts]# ll
total 96
-rw-r--r-- 1 root root 16549 Dec 8 2006 CHANGELOG.txt
-rwx------ 1 root root 4076 Feb 27 18:38 daemon-control
-rwxr-xr-x 1 root root 4076 Apr 22 2006 daemon-control-dist
drwxr-xr-x 2 root root 4096 Feb 27 18:36 data
-rw-r--r-- 1 root root 777 Feb 27 16:44 denyhosts.cfg
-rw-r--r-- 1 root root 20830 Aug 20 2006 denyhosts.cfg-dist
-rw-r--r-- 1 root root 18009 Dec 17 2005 LICENSE.txt
drwxr-xr-x 2 root root 4096 Feb 27 16:36 plugins
-rw-r--r-- 1 root root 3575 Feb 3 2006 README.txt
drwxr-xr-x 2 root root 4096 Feb 27 16:36 scripts
-rw-r--r-- 1 root root 1522 Apr 5 2006 setup.py
[root@localhost denyhosts]# ./daemon-control #DenyHosts命令格式
Usage: ./daemon-control {start [args...] | stop | restart [args...] | status | debug | condrestart [args...] }
For a list of valid args refer to:
$ denyhosts.py --help
[root@localhost denyhosts]# ./daemon-control start #启动DenyHosts
starting DenyHosts: /usr/bin/env python /usr/bin/denyhosts.py --daemon --config=/usr/share/denyhosts/denyhosts.cfg
如果要使DenyHosts每次重起后自动启动还需做如下设置:
[root@localhost denyhosts]# ln -s /usr/share/denyhosts/daemon-control /etc/init.d/denyhosts//建立符号链接
[root@localhost denyhosts]# chkconfig --add denyhosts//增加denyhosts服务进程
[root@localhost denyhosts]# chkconfig denyhosts on//设置开机启动denyhosts
denyhosts 0:off 1:off 2:on 3:on 4:on 5:on 6:off
或者修改/etc/rc.local文件:
[root@localhost denyhosts]# vi /etc/rc.local
加入下面这条命令
echo "/usr/share/denyhosts/daemon-control start">>/etc/rc.local
Feb 27 18:43:10 localhost login: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost= user=test
Feb 27 18:43:12 localhost login: FAILED LOGIN 1 FROM (null) FOR test, Authentication failure
Feb 27 18:43:15 localhost login: FAILED LOGIN 2 FROM (null) FOR test, Authentication failure
Feb 27 18:43:21 localhost login: FAILED LOGIN 3 FROM (null) FOR test, Authentication failure
Feb 27 18:43:26 localhost login: pam_unix(login:session): session opened for user test by LOGIN(uid=0)
Feb 27 18:43:26 localhost login: LOGIN ON tty1 BY test
Feb 27 18:45:32 localhost su: pam_unix(su:auth): authentication failure; logname=test uid=500 euid=0 tty=tty1 ruser=test rhost= user=root
Feb 27 18:45:47 localhost su: pam_unix(su-l:session): session opened for user root by test(uid=500)
Feb 27 19:00:03 localhost sshd[19861]: Accepted password for root from 192.168.40.41 port 4289 ssh2