/etc/hosts.deny ignored?!

binro · Posted: Mon Mar 24, 2008 1:01 pm Post subject: /etc/hosts.deny ignored?!

I have recently been tuning DenyHosts to better block dictionary attacks against sshd and proftpd. My rules are now good but the attacks continue (this in itself is not a worry since I only allow logon via RSA public keys). The attacking IP address is added to /etc/hosts.deny but seems to be ignored.
I have checked that: xinetd is running and was compiled with the tcpd flag; there are no bad rules in hosts.allow.

Any ideas welcome, I am a bit stumped.

_________________
"Ship me somewheres east of Suez, where the best is like the worst,
Where there ain't no Ten Commandments an' a man can raise a thirst"
from "Mandalay" by Rudyard Kipling

alex.blackbit · Advocate Joined: 26 Jul 2005 Posts: 2397

i don't understand why you need xinetd. neither sshd nor proftpd need it, right?

binro · Posted: Mon Mar 24, 2008 6:32 pm Post subject:

jcat · Veteran Joined: 26 May 2006 Posts: 1337

Does you /etc/hosts.deny work at all?

Try some simple tests, back up your current allow and deny files reconfigure as needed for some simple tests.
If the files are definitely working ok, then you can only presume that it's your rules that aren't correct (in one file or the other or both).

If you can't work it out feel free to post the contents of both files.

Cheers,
jcat

binro · Posted: Tue Mar 25, 2008 11:35 am Post subject:

Here is my hosts.allow with the local address range (192.168) not allowed by default.

Here is a segment of hosts.deny where I have deliberately got myself blacklisted:

Yet I can still logon if I use a valid userid/password. I should not even get a connection.
_________________
"Ship me somewheres east of Suez, where the best is like the worst,
Where there ain't no Ten Commandments an' a man can raise a thirst"
from "Mandalay" by Rudyard Kipling

jcat · Veteran Joined: 26 May 2006 Posts: 1337

First of all, your

spamd: 127.0.0.1

is irrelevant, because you have

ALL: LOCAL

already allowing anything from local to anything (using tcpd wrappers anyway).

How are you testing the rule? Logging in locally using ssh?

Have you tried

Cyker · Veteran Joined: 15 Jun 2006 Posts: 1746

Stupid question: You have compiled tcpwrappers support into xinetd, openssh and proftpd?

binro · Posted: Wed Mar 26, 2008 3:48 pm Post subject:

binro · Posted: Wed Mar 26, 2008 3:49 pm Post subject:

binro · Posted: Wed Mar 26, 2008 7:29 pm Post subject:

More info: proftpd is reading hosts.deny, connections do get blocked. However, connects to sshd from the same address are permitted, unless I put

jcat · Veteran Joined: 26 May 2006 Posts: 1337

Hi,

While it's strange that your hosts.deny rule ALL: 192.168.1.57 is not effective, it is best practice to deny everything with ALL: ALL and then specifically allow exceptions on hosts.allow.

What happens if you deny everything then add

binro · Posted: Wed Mar 26, 2008 10:06 pm Post subject:

jcat · Veteran Joined: 26 May 2006 Posts: 1337

RiverRat · n00b Joined: 07 Oct 2004 Posts: 65 Location: Colorado

RiverRat · n00b Joined: 07 Oct 2004 Posts: 65 Location: Colorado

The solution is here: https://forums.gentoo.org/viewtopic-p-4146699.html#4146699
_________________
RiverRat

binro · Posted: Wed May 21, 2008 10:39 am Post subject:

depontius · Advocate Joined: 05 May 2004 Posts: 3509

Just another note...

There is a directive in /etc/ssh/sshd_config called "AllowGroups". I have added a group put users I want to be able to allow to ssh into the box in that group, then use that group with the preceding directive. This gives another layer of security to OpenSSH, especially with all of the current brute-force attacks going on. They can try and brute-force any account under the sun, but they've got try to brute-force the right account to even start to get anywhere. You probably also want to "PermitRootLogin no" in that same file. I simply don't understand why Gentoo has this default to "yes". Every etc-update I have to go back and change it.

Another thought...

Are you connecting from random systems, or from your personal laptop? I have things set in multiple layers to only allow incoming ssh from my employer's IP range. But I also have OpenVPN, and allow incoming connections from anywhere, since it has certificate-based connections that aren't open to simple brute-force attack. When I want to ssh in while traveling, I open the OpenVPN tunnel, then ssh through that, not for double-encryption, but because I feel that OpenVPN is safer to expose to general connections.
_________________
.sigs waste space and bandwidth

binro · Posted: Wed May 21, 2008 12:58 pm Post subject:

I connect from many places (including my phone - my SE P1i runs PuTTY!

) and I even allow root logins. However I have:

jcat · Veteran Joined: 26 May 2006 Posts: 1337

Even if you use keys to auth, I would still feel uncomfortable allowing root login via ssh. Just because it's good practice and one day there will be a security whole discovered that will allow a hacker to take advantage of this set-up temporarily until it's fixed (you have to assume the worst!). Just my .02

Glad to here your hosts.deny is now working

Cheers,
jcat