Bug 88781 - [NEW PORT] security/denyhosts: Script to thwart ssh attacks
Summary: [NEW PORT] security/denyhosts: Script to thwart ssh attacks
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: Normal Affects Only Me
Assignee: freebsd-ports-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2005-11-10 09:50 UTC by Mohacsi Janos
Modified: 2005-11-11 06:46 UTC (History)
0 users

See Also:


Attachments
denyhosts-1.1.2.shar (8.87 KB, text/plain)
2005-11-10 09:50 UTC, Mohacsi Janos
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Mohacsi Janos 2005-11-10 09:50:13 UTC
DenyHosts is a script intended to be run by *ix system administrators to 
help thwart ssh server attacks.

If you've ever looked at your ssh log (/var/log/auth.log ) you may be alarmed 
to see how many hackers attempted to gain access to your server. 
Denyhosts helps you:
- Parses /var/log/auth.log to find all login attempts
- Can be run from the command line, cron or as a daemon (new in 0.9)
- Records all failed login attempts for the user and offending host
- For each host that exceeds a threshold count, records the evil host
- Keeps track of each non-existent user (eg. sdada) when a login attempt failed.
- Keeps track of each existing user (eg. root) when a login attempt failed.
- Keeps track of each offending host (hosts can be purged )
- Keeps track of suspicious logins 
- Keeps track of the file offset, so that you can reparse the same file
- When the log file is rotated, the script will detect it 
- Appends /etc/hosts.allow
- Optionally sends an email of newly banned hosts and suspicious logins.
- Resolves IP addresses to hostnames, if you want

WWW:	http://denyhosts.sourceforge.net/

Generated with FreeBSD Port Tools 0.63
Comment 1 Vanilla I. Shu freebsd_committer freebsd_triage 2005-11-11 06:46:22 UTC
State Changed
From-To: open->closed

Committed, thanks.