DenyHosts: Automated SSH Brute Force Response System

In 2007 the way to stop SSH password-guessing bots was DenyHosts: it watched the auth log and wrote offenders into /etc/hosts.deny, where tcp_wrappers refused them. Both halves are gone. DenyHosts has not had a release since 2015, and OpenSSH dropped tcp_wrappers support in 6.7 (2014), so hosts.deny no longer does anything to sshd at all. The tool that took over is fail2ban: same idea, the ban goes into the firewall instead, and it is in every repository. The page keeps its 2007 address because people still link here for “block SSH brute force on Ubuntu”; the answer below is the current one.

Install

sudo apt install fail2ban

On Debian and Ubuntu the package ships /etc/fail2ban/jail.d/defaults-debian.conf, which enables the sshd jail out of the box, reading authentication events straight from the systemd journal. Installing it is most of the work.

Tune it in jail.local

Never edit jail.conf; it is overwritten on upgrade. Overrides go in jail.local:

sudo tee /etc/fail2ban/jail.local > /dev/null <<'EOF'
[DEFAULT]
bantime  = 1h
findtime = 10m
maxretry = 5
ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24

[sshd]
enabled = true
EOF
sudo fail2ban-client -t && sudo systemctl restart fail2ban

maxretry failures within findtime earn a ban of bantime; put your own networks in ignoreip so a fat-fingered password from the office does not lock you out, the 2007 worry that still applies. fail2ban-client -t checks the configuration before the restart.

For a host that is hammered around the clock, make repeat offenders hurt more:

bantime.increment = true
bantime.maxtime   = 1w

Read it

sudo fail2ban-client status
sudo fail2ban-client status sshd

Status for the jail: sshd
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     0
|  `- Journal matches:  _SYSTEMD_UNIT=ssh.service + _COMM=sshd
`- Actions
   |- Currently banned: 1
   |- Total banned:     1
   `- Banned IP list:   203.0.113.5

The Journal matches line tells you it is reading the journal (backend = systemd), which means there is no /var/log/auth.log to rotate or lose. The bans themselves are nftables or iptables rules; sudo nft list ruleset | grep f2b or sudo iptables -L f2b-sshd -n shows them.

Ban and unban by hand

sudo fail2ban-client set sshd banip 203.0.113.5
sudo fail2ban-client set sshd unbanip 203.0.113.5
sudo fail2ban-client get sshd maxretry

The get form reads any live setting without opening a file.

What DenyHosts had that fail2ban does not

The 2007 text praised DenyHosts’ central reporting: everyone’s bans shared and pre-loaded. fail2ban has no built-in equivalent; the modern version of that idea is CrowdSec, which runs alongside or instead of fail2ban and pulls a community blocklist. For a single server, fail2ban plus key-only authentication (PasswordAuthentication no in sshd_config) removes the problem rather than rate-limiting it: a bot cannot guess a key.

DenyHosts is a project that adds a protective layer to an SSH server by automatically blocking malicious hosts that use brute force or dictionary attacks. If you have SSH services enabled and accessible from the internet, you will likely have thousands of failed login attempts from several sources within a very short period of time. DenyHosts monitors all login attempts, and based on a customizable rule-set can block hosts from making further connections if an attack pattern is matched.

Using tcp_wrappers, the DenyHosts service elegantly manages entries in the /etc/hosts.deny file, adding and removing hosts when thresholds are crossed. e.g. Three failed logins with unknown user accounts; Three failed logins with root account; Five failed logins with known user accounts; Unblock host after a set period of time; etc. You can also specify whether DenyHosts blocks access to SSH or ALL services, thereby mitigating any other attack vectors the offender might try next.

A most valuable feature that makes DenyHosts even more attractive is the optional centralized reporting system. The service can be configured to report all abusive hosts to the DenyHosts collection server, and automatically import a list of IP addresses that others have reported. This network of intelligence gathering and incident response helps to thwart a large number of attacks before they happen, because the attackers (most of which are automated bots) are blocked before they have a chance to move on to other protected servers.Other useful features include email notification when hosts are blocked, and counter resets after successful authentication to prevent accidental blacklisting caused by fat fingered admins. :)

For those of you using Ubuntu 7.04 (Feisty Fawn) and above, it is available in the Universe repository:

sudo apt-get install denyhosts

Edit and customize /etc/denyhosts.conf for your desired options, and restart the service:

sudo /etc/init.d/denyhosts restart

Ubuntu 6.06.1 LTS will need a manual installation, as it is not included in the repositories.

Be sure to check out the project at http://denyhosts.sourceforge.net.