[wellylug] Securing my ssh box

[David Antliff]

On Tue, 22 Aug 2006, Jim Cheetham wrote:
> Also consider deploying something like DenyHosts

Well, I have installed this (really easy with Debian) and it's already 
blacklisted about 20 IP addresses it harvested from my logs. I also 
watched it automatically cut off a hacking attempt in seconds.

It's important to be aware of the consequences of accidentally triggering 
it yourself.

Does anyone know if entries in /etc/hosts.allow override those in 
/etc/hosts.deny? This could be useful if you have a few known-good hosts 
that you don't want DenyHosts to accidentally blacklist. I read about a 
file called 'allowedhosts' in the DenyHosts config but I wasn't able to 
find this file or any info about creating it.

(it seems that DenyHosts development has been quite rapid lately, so if 
you looked at it more than, say, 6 months ago, it might be worth checking 
out again).

-- 
David.