{"id":371,"date":"2012-05-27T09:15:32","date_gmt":"2012-05-27T09:15:32","guid":{"rendered":"https:\/\/www.rosehosting.com\/blog\/?p=371"},"modified":"2022-12-08T06:14:41","modified_gmt":"2022-12-08T12:14:41","slug":"how-to-improve-your-debian-vps-security-by-using-denyhosts-and-logwatch","status":"publish","type":"post","link":"https:\/\/www.rosehosting.com\/blog\/how-to-improve-your-debian-vps-security-by-using-denyhosts-and-logwatch\/","title":{"rendered":"How to improve your Debian VPS security by using DenyHosts and Logwatch"},"content":{"rendered":"
What is DenyHosts?<\/strong><\/p>\n It is a python script intended to be run by GNU\/Linux system administrators and users to help thwart SSH server attacks which are also known as dictionary based attacks and brute force attacks. It has the ability to run as a daemon and it can automatically block attackers and prevent them from gaining access to your server.<\/p>\n <\/p>\n What is LogWatch?<\/strong><\/p>\n Logwatch is a customizable log analysis system. Logwatch parses through your system’s logs and creates a report analyzing areas that you specify and can report them by email.<\/p>\n – Installing and configuring DenyHosts<\/strong><\/span><\/p>\n 1. Make sure your system is always up-to-date:<\/strong><\/p>\n 2. Install DenyHosts by executing the following command:<\/strong><\/p>\n once it is installed, denyhosts has to be configured. Anyhow, you can use the configuration below which is tested and works perfectly fine.<\/p>\n 3. Backup the original configuration file and create a new one using the following command:<\/strong><\/p>\napt-get update && apt-get -y upgrade<\/pre>\n
apt-get -y install denyhosts<\/pre>\n
cp \/etc\/denyhosts.conf{,_ORIG} && cat > \/etc\/denyhosts.conf <<EOF\r\n#xxxxxx optional options xxxxxx#\r\nADMIN_EMAIL = your@email.com\r\nSMTP_HOST = localhost\r\nSMTP_PORT = 25\r\nSMTP_FROM = DenyHosts <nobody@localhost>\r\nSMTP_SUBJECT = DenyHosts Report\r\nAGE_RESET_VALID=5d\r\nAGE_RESET_ROOT=25d\r\nAGE_RESET_RESTRICTED=25d\r\nAGE_RESET_INVALID=10d\r\n#xxxxxx end optional options xxxxxx#\r\n\r\n#xxxxxx required options xxxxxx#\r\nSECURE_LOG = \/var\/log\/auth.log\r\nHOSTS_DENY = \/etc\/hosts.deny\r\nPURGE_DENY =\r\nBLOCK_SERVICE = ALL\r\nDENY_THRESHOLD_INVALID = 5\r\nDENY_THRESHOLD_VALID = 10\r\nDENY_THRESHOLD_ROOT = 1\r\nDENY_THRESHOLD_RESTRICTED = 1\r\nWORK_DIR = \/var\/lib\/denyhosts\r\nSUSPICIOUS_LOGIN_REPORT_ALLOWED_HOSTS=YES\r\nHOSTNAME_LOOKUP=YES\r\nLOCK_FILE = \/var\/run\/denyhosts.pid\r\n#xxxxxx end required options xxxxxx#\r\n\r\n#xxxxxx daemon specific options xxxxxx#\r\nDAEMON_LOG = \/var\/log\/denyhosts\r\nDAEMON_SLEEP = 30s\r\nDAEMON_PURGE = 1h\r\n#xxxxxx daemon specific options xxxxxx#\r\nEOF<\/pre>\n