Hi..
My denyhost is not working as I expected....
I have root fail set to 1..
And it takes 2 or 3 or 4 before it blocks the IP address..
Any clue on what could be happening?
Have I miss configured it somehow??
TIA
Marvin
On Sat, 2010-04-24 at 20:41 -0700, Marvin Kosmal wrote:
Have I miss configured it somehow??
Perhaps you have the time set to a longer interval than the attempts?
In many cases people set up denyhosts when they really don't need it.
Do you remotely log in from only a single address? Or just a few addresses? If so, just put ALL: ALL in /etc/hosts.deny and put your allowed IP addresses into /etc/hosts.allow. Then everything will be denied by default except for the addresses you have specifically allowed. No need to run denyhosts at all in that situation.
On 4/24/10, Frank Cox theatre@sasktel.net wrote:
On Sat, 2010-04-24 at 20:41 -0700, Marvin Kosmal wrote:
Have I miss configured it somehow??
Perhaps you have the time set to a longer interval than the attempts?
In many cases people set up denyhosts when they really don't need it.
Do you remotely log in from only a single address? Or just a few addresses? If so, just put ALL: ALL in /etc/hosts.deny and put your allowed IP addresses into /etc/hosts.allow. Then everything will be denied by default except for the addresses you have specifically allowed. No need to run denyhosts at all in that situation.
-- MELVILLE THEATRE ~ Melville Sask ~ http://www.melvilletheatre.com
Hi
Thanks for the reply..
I share this box with others... So...
But, the problem, I think, was the Daemon sleep time.. I reset it to 3 sec...
Thanks again for the come back..
Marvin
On Sat, 2010-04-24 at 21:54 -0600, Frank Cox wrote:
On Sat, 2010-04-24 at 20:41 -0700, Marvin Kosmal wrote:
Have I miss configured it somehow??
Perhaps you have the time set to a longer interval than the attempts?
In many cases people set up denyhosts when they really don't need it.
---- what? The only scenarios where you don't need something like denyhosts are where only publickey authentication is allowed (no passwords) or the system is not connected to the Internet and cannot be accessed by untrusted users.
Craig
On Sun, 2010-04-25 at 06:50 -0700, Craig White wrote:
The only scenarios where you don't need something like denyhosts are where only publickey authentication is allowed (no passwords) or the system is not connected to the Internet and cannot be accessed by untrusted users.
Or, to be pedantic, when you don't have any services... ;-)
On Sun, 2010-04-25 at 06:50 -0700, Craig White wrote:
what? The only scenarios where you don't need something like denyhosts are where only publickey authentication is allowed (no passwords) or the system is not connected to the Internet and cannot be accessed by untrusted users.
You failed to comprehend what I wrote.
Put ALL: ALL in /etc/hosts.deny
Put the IP addresses (and services -- read man hosts.allow for the syntax) that you need to access the box from into /etc/host.allow.
Done.
Again there is no need to run denyhosts on a computer that you access only from specific outside IP addresses.
On 4/25/10, Frank Cox theatre@sasktel.net wrote:
On Sun, 2010-04-25 at 06:50 -0700, Craig White wrote:
what? The only scenarios where you don't need something like denyhosts are where only publickey authentication is allowed (no passwords) or the system is not connected to the Internet and cannot be accessed by untrusted users.
You failed to comprehend what I wrote.
Put ALL: ALL in /etc/hosts.deny
Put the IP addresses (and services -- read man hosts.allow for the syntax) that you need to access the box from into /etc/host.allow.
Done.
Again there is no need to run denyhosts on a computer that you access only from specific outside IP addresses.
-- MELVILLE THEATRE ~ Melville Sask ~ http://www.melvilletheatre.com
HI
I can appreciate what you said.. I am the OP.
But, in this particular case.
I share this computer, that I installed denyhost, on.
And access that computer from my DSL box which changes IP address..
Thanks for the input
Marvin
On Sun, 2010-04-25 at 13:20 -0700, Marvin Kosmal wrote:
I share this computer, that I installed denyhost, on.
And access that computer from my DSL box which changes IP address..
Does your DSL address change only within a limited range of possible addresses? If so, you can still put ALL: ALL into /etc/hosts.deny and add the range that you need into /etc/hosts.allow if you like. It's not quite as secure as using only a static address to access the box, but you're still not giving world+dog one or more shots at your computer before denyhosts shuts them down.
On 4/25/10, Frank Cox theatre@sasktel.net wrote:
On Sun, 2010-04-25 at 13:20 -0700, Marvin Kosmal wrote:
I share this computer, that I installed denyhost, on.
And access that computer from my DSL box which changes IP address..
Does your DSL address change only within a limited range of possible addresses? If so, you can still put ALL: ALL into /etc/hosts.deny and add the range that you need into /etc/hosts.allow if you like. It's not quite as secure as using only a static address to access the box, but you're still not giving world+dog one or more shots at your computer before denyhosts shuts them down. -- MELVILLE THEATRE ~ Melville Sask ~ http://www.melvilletheatre.com
--
Great Idea..
I will do that..
Thanks
Marvin