DenyHosts 阻止SSH暴力攻击
默认配置文件路径：/etc/denyhosts/denyhosts.cfg
配置文件内容详细说明：
############ THESE SETTINGS ARE REQUIRED ############
# 系统安全日志文件，主要获取ssh信息
SECURE_LOG = /var/log/secure
# 拒绝写入IP文件 hosts.deny
HOSTS_DENY = /etc/hosts.deny
# #过多久后清除已经禁止的，其中w代表周，d代表天，h代表小时，s代表秒，m代表分钟
PURGE_DENY = 4w
# denyhosts所要阻止的服务名称
BLOCK_SERVICE = sshd
# 允许无效用户登录失败的次数
DENY_THRESHOLD_INVALID = 3
# 允许普通用户登录失败的次数
DENY_THRESHOLD_VALID = 10
# 允许ROOT用户登录失败的次数
DENY_THRESHOLD_ROOT = 6
# 设定 deny host 写入到该资料夹
DENY_THRESHOLD_RESTRICTED = 1
# 将deny的host或ip纪录到Work_dir中
WORK_DIR = /var/lib/denyhosts
SUSPICIOUS_LOGIN_REPORT_ALLOWED_HOSTS=YES
# 是否做域名反解
HOSTNAME_LOOKUP=YES
# 将DenyHOts启动的pid纪录到LOCK_FILE中，已确保服务正确启动，防止同时启动多个服务
LOCK_FILE = /var/lock/subsys/denyhosts
############ THESE SETTINGS ARE OPTIONAL ############
# 管理员Mail地址
ADMIN_EMAIL = root
SMTP_HOST = localhost
SMTP_PORT = 25
SMTP_FROM = DenyHosts
SMTP_SUBJECT = DenyHosts Report from $[HOSTNAME]
# 有效用户登录失败计数归零的时间
AGE_RESET_VALID=5d
# ROOT用户登录失败计数归零的时间
AGE_RESET_ROOT=25d
# 用户的失败登录计数重置为0的时间(/usr/share/denyhosts/restricted-usernames)
AGE_RESET_RESTRICTED=25d
# 无效用户登录失败计数归零的时间
AGE_RESET_INVALID=10d
######### THESE SETTINGS ARE SPECIFIC TO DAEMON MODE ##########
# denyhosts log文件
DAEMON_LOG = /var/log/denyhosts
DAEMON_SLEEP = 30s
# 该项与PURGE_DENY 设置成一样，也是清除hosts.deniedssh 用户的时间
DAEMON_PURGE = 1h
启动的时候查看日志获取到的加载的配置文件内容：
2022-04-16 16:11:09,631 - prefs : INFO DenyHosts configuration settings:
2022-04-16 16:11:09,631 - prefs : INFO ADMIN_EMAIL: [None]
2022-04-16 16:11:09,631 - prefs : INFO AGE_RESET_INVALID: [864000]
2022-04-16 16:11:09,631 - prefs : INFO AGE_RESET_RESTRICTED: [2160000]
2022-04-16 16:11:09,631 - prefs : INFO AGE_RESET_ROOT: [2160000]
2022-04-16 16:11:09,631 - prefs : INFO AGE_RESET_VALID: [432000]
2022-04-16 16:11:09,631 - prefs : INFO ALLOWED_HOSTS_HOSTNAME_LOOKUP: [no]
2022-04-16 16:11:09,631 - prefs : INFO BLOCK_SERVICE: [sshd]
2022-04-16 16:11:09,631 - prefs : INFO DAEMON_LOG: [/var/log/denyhosts]
2022-04-16 16:11:09,631 - prefs : INFO DAEMON_LOG_MESSAGE_FORMAT: [%(asctime)s - %(name)-12s: %(levelname)-8s %(message)s]
2022-04-16 16:11:09,631 - prefs : INFO DAEMON_LOG_TIME_FORMAT: [None]
2022-04-16 16:11:09,631 - prefs : INFO DAEMON_PURGE: [3600]
2022-04-16 16:11:09,631 - prefs : INFO DAEMON_SLEEP: [30]
2022-04-16 16:11:09,631 - prefs : INFO DENY_THRESHOLD_INVALID: [5]
2022-04-16 16:11:09,631 - prefs : INFO DENY_THRESHOLD_RESTRICTED: [1]
2022-04-16 16:11:09,631 - prefs : INFO DENY_THRESHOLD_ROOT: [1]
2022-04-16 16:11:09,631 - prefs : INFO DENY_THRESHOLD_VALID: [10]
2022-04-16 16:11:09,632 - prefs : INFO FAILED_ENTRY_REGEX: [None]
2022-04-16 16:11:09,632 - prefs : INFO FAILED_ENTRY_REGEX2: [None]
2022-04-16 16:11:09,632 - prefs : INFO FAILED_ENTRY_REGEX3: [None]
2022-04-16 16:11:09,632 - prefs : INFO FAILED_ENTRY_REGEX4: [None]
2022-04-16 16:11:09,632 - prefs : INFO FAILED_ENTRY_REGEX5: [None]
2022-04-16 16:11:09,632 - prefs : INFO FAILED_ENTRY_REGEX6: [None]
2022-04-16 16:11:09,632 - prefs : INFO FAILED_ENTRY_REGEX7: [None]
2022-04-16 16:11:09,632 - prefs : INFO HOSTNAME_LOOKUP: [YES]
2022-04-16 16:11:09,632 - prefs : INFO HOSTS_DENY: [/etc/hosts.deny]
2022-04-16 16:11:09,632 - prefs : INFO LOCK_FILE: [/var/lock/subsys/denyhosts]
2022-04-16 16:11:09,632 - prefs : INFO PLUGIN_DENY: [None]
2022-04-16 16:11:09,632 - prefs : INFO PLUGIN_PURGE: [None]
2022-04-16 16:11:09,632 - prefs : INFO PURGE_DENY: [None]
2022-04-16 16:11:09,632 - prefs : INFO PURGE_THRESHOLD: [0]
2022-04-16 16:11:09,632 - prefs : INFO RESET_ON_SUCCESS: [no]
2022-04-16 16:11:09,632 - prefs : INFO SECURE_LOG: [/var/log/secure]
2022-04-16 16:11:09,632 - prefs : INFO SMTP_DATE_FORMAT: [%a, %d %b %Y %H:%M:%S %z]
2022-04-16 16:11:09,632 - prefs : INFO SMTP_FROM: [DenyHosts ]
2022-04-16 16:11:09,632 - prefs : INFO SMTP_HOST: [localhost]
2022-04-16 16:11:09,632 - prefs : INFO SMTP_PASSWORD: [None]
2022-04-16 16:11:09,632 - prefs : INFO SMTP_PORT: [25]
2022-04-16 16:11:09,632 - prefs : INFO SMTP_SUBJECT: [DenyHosts Report]
2022-04-16 16:11:09,632 - prefs : INFO SMTP_USERNAME: [None]
2022-04-16 16:11:09,632 - prefs : INFO SSHD_FORMAT_REGEX: [None]
2022-04-16 16:11:09,632 - prefs : INFO SUCCESSFUL_ENTRY_REGEX: [None]
2022-04-16 16:11:09,632 - prefs : INFO SUSPICIOUS_LOGIN_REPORT_ALLOWED_HOSTS: [YES]
2022-04-16 16:11:09,632 - prefs : INFO SYNC_DOWNLOAD: [yes]
2022-04-16 16:11:09,632 - prefs : INFO SYNC_DOWNLOAD_RESILIENCY: [18000]
2022-04-16 16:11:09,632 - prefs : INFO SYNC_DOWNLOAD_THRESHOLD: [3]
2022-04-16 16:11:09,632 - prefs : INFO SYNC_INTERVAL: [3600]
2022-04-16 16:11:09,632 - prefs : INFO SYNC_SERVER: [None]
2022-04-16 16:11:09,632 - prefs : INFO SYNC_UPLOAD: [yes]
2022-04-16 16:11:09,632 - prefs : INFO SYSLOG_REPORT: [no]
2022-04-16 16:11:09,632 - prefs : INFO WORK_DIR: [/usr/share/denyhosts/data]
rpm -ivh http://rpmfind.net/linux/dag/redhat/el7/en/x86_64/dag/RPMS/denyhosts-2.6-5.el7.rf.noarch.rpm
# http://mirror.neu.edu.cn/fedora-epel/7/x86_64/d/denyhosts-2.9-4.el7.noarch.rpm
# rpm -ivh https://test.jdd966.cn/denyhosts-2.6-5.el7.rf.noarch.rpm
mv /etc/denyhosts/denyhosts.cfg /etc/denyhosts/denyhosts.cfg.bak
# 配置文件中的xxx根据实际情况修改
cat >> /etc/denyhosts/denyhosts.cfg << "EOF"
SECURE_LOG = /var/log/secure
HOSTS_DENY = /etc/hosts.deny
PURGE_DENY = 5m
BLOCK_SERVICE = sshd
DENY_THRESHOLD_INVALID = 5
DENY_THRESHOLD_VALID = 5
DENY_THRESHOLD_ROOT = 5
DENY_THRESHOLD_RESTRICTED = 5
WORK_DIR = /usr/share/denyhosts/data
SUSPICIOUS_LOGIN_REPORT_ALLOWED_HOSTS=YES
HOSTNAME_LOOKUP=NO
LOCK_FILE = /var/lock/subsys/denyhosts
ADMIN_EMAIL = xxxxxxx
SMTP_HOST = xxxxxxxx
SMTP_PORT = 25
SMTP_FROM = DenyHosts
SMTP_USERNAME = xxxxx@126.com
SMTP_PASSWORD = xxxxxxxxx
SMTP_SUBJECT = DenyHosts Report from $[HOSTNAME]
ALLOWED_HOSTS_HOSTNAME_LOOKUP = NO
AGE_RESET_VALID = 3m
AGE_RESET_ROOT = 3m
AGE_RESET_RESTRICTED = 3m
AGE_RESET_INVALID = 3m
DAEMON_LOG = /var/log/denyhosts
DAEMON_SLEEP = 30s
DAEMON_PURGE = 5m
SYNC_UPLOAD = no
SYNC_DOWNLOAD = no
EOF
systemctl enable denyhosts && systemctl start denyhosts && systemctl status denyhosts
安装脚本
#!/bin/bash
echo "在线安装denyhosts"
# rpm -ivh https://test.jdd966.cn/denyhosts-2.6-5.el7.rf.noarch.rpm
rpm -ivh http://rpmfind.net/linux/dag/redhat/el7/en/x86_64/dag/RPMS/denyhosts-2.6-5.el7.rf.noarch.rpm
echo "启动服务，停止服务，备份配置文件"
systemctl start denyhosts && systemctl stop denyhosts && mv /etc/denyhosts/denyhosts.cfg /etc/denyhosts/denyhosts.cfg.bak
echo "新添加配置文件内容"
cat >> /etc/denyhosts/denyhosts.cfg << "EOF"
SECURE_LOG = /var/log/secure
HOSTS_DENY = /etc/hosts.deny
PURGE_DENY = 5m
BLOCK_SERVICE = sshd
DENY_THRESHOLD_INVALID = 5
DENY_THRESHOLD_VALID = 5
DENY_THRESHOLD_ROOT = 5
DENY_THRESHOLD_RESTRICTED = 5
WORK_DIR = /usr/share/denyhosts/data
SUSPICIOUS_LOGIN_REPORT_ALLOWED_HOSTS=YES
HOSTNAME_LOOKUP=NO
LOCK_FILE = /var/lock/subsys/denyhosts
ADMIN_EMAIL = xxxxx
SMTP_HOST = smtp.qiye.aliyun.com
SMTP_PORT = 25
SMTP_FROM = DenyHosts
SMTP_USERNAME = xxxxx
SMTP_PASSWORD = xxxxx
SMTP_SUBJECT = DenyHosts Report
ALLOWED_HOSTS_HOSTNAME_LOOKUP = NO
AGE_RESET_VALID = 3m
AGE_RESET_ROOT = 3m
AGE_RESET_RESTRICTED = 3m
AGE_RESET_INVALID = 3m
DAEMON_LOG = /var/log/denyhosts
DAEMON_SLEEP = 30s
DAEMON_PURGE = 5m
SYNC_UPLOAD = no
SYNC_DOWNLOAD = no
EOF
echo "开机启动，启动服务，查看状态"
systemctl enable denyhosts && systemctl start denyhosts && systemctl status denyhosts