You can subscribe to this list here.
2005 |
Jan
|
Feb
|
Mar
(2) |
Apr
(5) |
May
(2) |
Jun
(1) |
Jul
(17) |
Aug
(82) |
Sep
(12) |
Oct
(11) |
Nov
(5) |
Dec
(12) |
---|---|---|---|---|---|---|---|---|---|---|---|---|
2006 |
Jan
(26) |
Feb
(14) |
Mar
(34) |
Apr
(34) |
May
(10) |
Jun
(8) |
Jul
(19) |
Aug
(10) |
Sep
(5) |
Oct
(8) |
Nov
(31) |
Dec
(27) |
2007 |
Jan
(29) |
Feb
(1) |
Mar
(3) |
Apr
(7) |
May
(19) |
Jun
(3) |
Jul
(40) |
Aug
(35) |
Sep
(41) |
Oct
(22) |
Nov
(6) |
Dec
(9) |
2008 |
Jan
(14) |
Feb
|
Mar
(24) |
Apr
(24) |
May
(28) |
Jun
(27) |
Jul
(60) |
Aug
(16) |
Sep
(3) |
Oct
(30) |
Nov
(32) |
Dec
(6) |
2009 |
Jan
(1) |
Feb
|
Mar
(2) |
Apr
(8) |
May
(14) |
Jun
(2) |
Jul
(27) |
Aug
(9) |
Sep
(6) |
Oct
(14) |
Nov
(12) |
Dec
(22) |
2010 |
Jan
(16) |
Feb
(43) |
Mar
(15) |
Apr
(11) |
May
(5) |
Jun
(4) |
Jul
(8) |
Aug
(31) |
Sep
(17) |
Oct
(4) |
Nov
(12) |
Dec
(4) |
2011 |
Jan
(22) |
Feb
(8) |
Mar
|
Apr
(10) |
May
(3) |
Jun
(2) |
Jul
(2) |
Aug
|
Sep
|
Oct
(7) |
Nov
(1) |
Dec
|
2012 |
Jan
|
Feb
|
Mar
|
Apr
(16) |
May
|
Jun
|
Jul
(6) |
Aug
(2) |
Sep
|
Oct
|
Nov
|
Dec
(4) |
2013 |
Jan
(1) |
Feb
|
Mar
(1) |
Apr
(7) |
May
|
Jun
(1) |
Jul
|
Aug
(17) |
Sep
|
Oct
(1) |
Nov
|
Dec
|
2014 |
Jan
(5) |
Feb
(1) |
Mar
(3) |
Apr
(3) |
May
|
Jun
(6) |
Jul
|
Aug
|
Sep
(3) |
Oct
|
Nov
(1) |
Dec
|
2015 |
Jan
(3) |
Feb
|
Mar
|
Apr
(5) |
May
|
Jun
|
Jul
(9) |
Aug
(2) |
Sep
(6) |
Oct
(5) |
Nov
(6) |
Dec
(4) |
2016 |
Jan
(1) |
Feb
(1) |
Mar
(2) |
Apr
|
May
(3) |
Jun
(3) |
Jul
(1) |
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
2017 |
Jan
(1) |
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
2020 |
Jan
(1) |
Feb
|
Mar
|
Apr
|
May
(1) |
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
From: 鍾詠麒 <qa...@gm...> - 2020-05-10 15:44:11
|
https://blog.patreon.com/patreon-response-to-covid-19 -- Jackson Chung |
From: 鍾詠麒 <qa...@gm...> - 2020-01-21 05:35:36
|
Thanks -- Jackson Chung |
From: Douglas J. <do...@do...> - 2017-01-11 16:00:29
|
Hi, I’m trying to get DenyHosts to work with Mac OS X Sierra and they’ve completely changed the logging system. I’m extracting a log of sshd errors which comes out in this format: 2017-01-10 20:36:30.011890-0500 localhost sshd[923]: error: maximum authentication attempts exceeded for djohnsto from ::1 port 49378 ssh2 [preauth] 2017-01-10 20:45:57.017895-0500 localhost sshd[1042]: error: maximum authentication attempts exceeded for root from 175.144.192.13 port 57251 ssh2 [preauth] 2017-01-10 20:55:06.612743-0500 localhost sshd[1154]: error: maximum authentication attempts exceeded for root from 186.183.187.157 port 39671 ssh2 [preauth] 2017-01-10 21:06:04.431491-0500 localhost sshd[1285]: error: maximum authentication attempts exceeded for root from 111.200.254.137 port 7560 ssh2 [preauth] 2017-01-10 21:14:36.159897-0500 localhost sshd[1400]: error: maximum authentication attempts exceeded for root from 113.124.163.248 port 36585 ssh2 [preauth] 2017-01-10 21:18:38.006617-0500 localhost sshd[1460]: error: maximum authentication attempts exceeded for root from 122.4.218.185 port 35886 ssh2 [preauth] 2017-01-10 21:26:55.522988-0500 localhost sshd[1573]: error: maximum authentication attempts exceeded for root from 92.246.184.96 port 3639 ssh2 [preauth] 2017-01-10 22:00:05.868704-0500 localhost sshd[1994]: error: maximum authentication attempts exceeded for root from 180.56.215.197 port 45414 ssh2 [preauth] 2017-01-10 22:19:04.996519-0500 localhost sshd[2250]: error: maximum authentication attempts exceeded for root from 88.255.199.46 port 60614 ssh2 [preauth] 2017-01-10 22:39:05.037431-0500 localhost sshd[2520]: error: maximum authentication attempts exceeded for root from 156.213.135.44 port 49282 ssh2 [preauth] 2017-01-10 23:14:58.258112-0500 localhost sshd[2965]: error: maximum authentication attempts exceeded for invalid user admin from 189.11.106.212 port 60485 ssh2 [preauth] 2017-01-10 23:15:58.093303-0500 localhost sshd[2979]: error: maximum authentication attempts exceeded for root from 114.252.87.240 port 20415 ssh2 [preauth] 2017-01-10 23:16:33.889693-0500 localhost sshd[2989]: error: maximum authentication attempts exceeded for root from 186.133.255.212 port 54982 ssh2 [preauth] 2017-01-10 23:22:35.789119-0500 localhost sshd[3068]: error: maximum authentication attempts exceeded for root from 186.130.76.169 port 43829 ssh2 [preauth] 2017-01-11 02:05:54.677038-0500 localhost sshd[4895]: error: maximum authentication attempts exceeded for invalid user support from 131.255.132.174 port 4439 ssh2 [preauth] 2017-01-11 02:14:16.921375-0500 localhost sshd[4984]: error: maximum authentication attempts exceeded for root from 58.19.145.5 port 55806 ssh2 [preauth] 2017-01-11 03:02:20.976151-0500 localhost sshd[5516]: error: PAM: unknown user for illegal user support from 123.31.34.18 2017-01-11 03:02:21.586793-0500 localhost sshd[5516]: error: PAM: authentication error for illegal user support from 123.31.34.18 2017-01-11 03:02:22.201227-0500 localhost sshd[5516]: error: Received disconnect from 123.31.34.18 port 62961:3: com.jcraft.jsch.JSchException: Auth fail [preauth] 2017-01-11 03:15:46.475934-0500 localhost sshd[5664]: error: maximum authentication attempts exceeded for invalid user admin from 123.123.147.102 port 54648 ssh2 [preauth]_________ I came up with the REGEX: SSHD_FORMAT_REGEX=(?P<timestamp>\S+?\s+?\S+?)\s+?\S+?\s+?(?P<Sender>.*?)\[(?P<PID>\d+?)\]:\s+error: (?P<message>.*) from (?P<host>.+?) port (?P<port>\d+).* Is there any problem with that? Most of my regex experience is with Perl. I have also gotten some errors that seem to come from the SYNC facility: 2017-01-11 10:28:03,938 - sync : ERROR invalid literal for int() with base 10: '' 2017-01-11 10:28:04,039 - sync : ERROR <Fault 105: "Error in get_new_hosts: Request instance has no attribute 'received_headers'"> Traceback (most recent call last): File "/Library/Python/2.7/site-packages/denyhosts/DenyHosts/sync.py", line 119, in receive_new_hosts self.__prefs.get("SYNC_DOWNLOAD_RESILIENCY")) File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/xmlrpclib.py", line 1243, in __call__ return self.__send(self.__name, args) File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/xmlrpclib.py", line 1602, in __request verbose=self.__verbose File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/xmlrpclib.py", line 1283, in request return self.single_request(host, handler, request_body, verbose) File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/xmlrpclib.py", line 1316, in single_request return self.parse_response(response) File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/xmlrpclib.py", line 1493, in parse_response return u.close() File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/xmlrpclib.py", line 800, in close raise Fault(**self._stack[0]) Fault: <Fault 105: "Error in get_new_hosts: Request instance has no attribute 'received_headers'"> Can anyone shed some light on that error? Thank you very much, Doug |
From: Jason L T. I. <ti...@ma...> - 2016-06-13 19:30:09
|
>>>>> "F" == FHDATA <fh...@un...> writes: F> out of curiosity and future possible troubleshooting where do I find F> what regular expressions DenyHosts is using? I am talking about the F> built-in ones ... where are there? They're all in regex.py; on EL7, that's in /usr/lib/python2.7/site-packages/DenyHosts. - J< |
From: FHDATA <fh...@un...> - 2016-06-12 21:08:50
|
hello, out of curiosity and future possible troubleshooting where do I find what regular expressions DenyHosts is using? I am talking about the built-in ones ... where are there? Thank you, F- |
From: Andreas S. <sch...@fa...> - 2016-05-26 21:56:14
|
On Thu, 26 May 2016, at 21:20, Jon P wrote: > I haven't seen any active dev in a while See https://github.com/denyhosts/denyhosts and https://github.com/janpascal/denyhosts_sync and e.g. https://github.com/denyhosts/denyhosts/issues/53 -- -- Andreas :-) |
From: Jon P <jo...@st...> - 2016-05-26 21:35:33
|
Im looking to setup my own denyhsots server. Saw on the FAQ to reach out to you as the code wasnt publicly available. How can one go about doing so? Thanks! LOVE LOVE LOVE the product!! I haven't seen any active dev in a while; is this something that can be taken over? |
From: Regina D. <te...@do...> - 2015-12-17 04:23:27
|
Hey! Open message <http://rvmp.co.uk/only.php?rps9> Regina Delgado |
From: Daniel S. <da...@ch...> - 2015-10-02 12:31:52
|
On 01/10/15 08:39 AM, Daniel Sutcliffe wrote: >> denyhosts 3 being focussed on python3 might explain the issue I am >> currently seeing, but it might also just be a dependency thing. The >> process runs for a bit and then falls over with some complaint about >> TupleType ... On Thu, Oct 1, 2015 at 7:52 AM, Jesse Smith <jes...@ya...> wrote: > The TupleType error was pretty common in the pre-release package of > DenyHost v3.0 (available on gitHub), but I think it had been fixed in > the final 3.0 release which is available through the website. Thanks Jesse, once I had compared everything I can see exactly how the GitHub v3.0 tag archive and the SF 3.0 release archive differ slightly, and the last commit fixes this error. I was pulling from v3.0 tag following using the 2.10 Fedora RPM as a starting point but updating to 3.0 which obviously bit me slightly - now I know where dev and issues are focussed I found this bug report: https://github.com/denyhosts/denyhosts/issues/39 I will open an issue for the problem mentioned in the subject line of this email on GitHub as it still seems to happen with 3.0 version May I suggest, as and when time allows, adding comments to the existing bug reports in this SF project (as I assume you have no control of these resources) redirecting either to new issues in GH or the appropriate fixed version of denyhosts. I shall do this to the 2 I mentioned earlier once I have created a ticket for it on GH. Thanks for all your help, Cheers /dan -- Daniel Sutcliffe <da...@ch...> Chair Four Development Group LLC |
From: Daniel S. <da...@ch...> - 2015-10-02 12:17:18
|
I wrote: >>> This is probably not the thread or the place to really >>> discuss this though, this being the defunct denyhosts projects mailing >>> list. Where is the active forum/list for discussions on the new >>> GitHub/SFdenhost? On Thu, Oct 1, 2015 at 8:19 PM, Jesse Smith <jes...@ya...> wrote: > Bugs, discussion, etc all take place on the new project's GitHub page. > This mailing list is no way associated with the new project, I just > happen to still be subscribe to it so I can pick up on problems people > run into with the old project. I for one am very glad you are here providing the redirect :) > Documentation and final releases are available on the new project's SF > page. GitHub is used for discussion and bug tracking. Thanks for clearing this up now makes perfect sense: Docs & Releases: https://sourceforge.net/projects/denyhost/ Active Dev & Issues: https://github.com/denyhosts/denyhosts I'm sure you shall see me on GitHub soon enough Thanks /dan -- Daniel Sutcliffe <da...@ch...> Chair Four Development Group LLC |
From: Jesse S. <jes...@ya...> - 2015-10-02 00:19:05
|
>> denyhosts 3 being focussed on python3 might explain the issue I am >> currently seeing, but it might also just be a dependency thing. The >> process runs for a bit and then falls over with some complaint about >> TupleType ... This is probably not the thread or the place to really >> discuss this though, this being the defunct denyhosts projects mailing >> list. Where is the active forum/list for discussions on the new >> GitHub/SFdenhost? Bugs, discussion, etc all take place on the new project's GitHub page. This mailing list is no way associated with the new project, I just happen to still be subscribe to it so I can pick up on problems people run into with the old project. Documentation and final releases are available on the new project's SF page. GitHub is used for discussion and bug tracking. |
From: Jesse S. <jes...@ya...> - 2015-10-01 11:52:06
|
On 01/10/15 08:39 AM, Daniel Sutcliffe wrote: >>>>>>> "DS" == Daniel Sutcliffe <da...@ch...> writes: >> DS> I realized after I sent the above that the fact that systemd has >> DS> become almost ubiquitous is making it harder and harder to support >> DS> packages for EL6 and earlier and was thus am a lot less surprised >> DS> than I was when I first found this discrepancy. > > On Wed, Sep 30, 2015 at 7:38 PM, Jason L Tibbitts III <ti...@ma...> wrote: >> Well, initscripts aren't that hard. > > This is very true, but when they have been removed from the > spec/src.rpm it makes the task more than the trivial tweaking and > rebuilding. > >> It's more about me not being able to remember what ancient python >> version is on which EL release, as well as having no way to actually test >> the package. > > That is always the headache, made easier in these days of > virtualization, but when it comes down to it there are just not enough > hours in the day. > >> The Fedora package will be using python3 once I get it updated, which >> cuts out EPEL (though EPEL7 does have some of python3 at this point). > > denyhosts 3 being focussed on python3 might explain the issue I am > currently seeing, but it might also just be a dependency thing. The > process runs for a bit and then falls over with some complaint about > TupleType ... This is probably not the thread or the place to really > discuss this though, this being the defunct denyhosts projects mailing > list. Where is the active forum/list for discussions on the new > GitHub/SFdenhost? > >> DS> I have just managed to produce a denyhosts-3.0-0.el6.noarch.rpm so >> DS> soon enough I shall have a better idea if my original issues are >> DS> going to be improved by this later version of denyhosts. >> >> Well, if you want to maintain denyhosts there, feel free to sign up. I >> can click all of the necessary buttons to give you access. > > I have no problem making my specs and RPMs available publically, not > sure how qualified they'll be to actually have them live in EPEL but > lets getting a working RPM first and think about where the spec > belongs later. I do welcome the opportunity to contribute to denyhosts > and/or EPEL whatever. > > Back on topic: although my 3.0 install isn't exactly fully functional > yet, I can already see that hosts-restricted is still getting 0 count > entries for attempted logins that aren't anything to do with > restricted-usernames - and checking the AGE_RESET_ bit of code I > suspect is causing this does not seem to contain any changes... > > Let's continue this discussion in a more relevant place though, please advise, > Cheers > /dan > Dan, The TupleType error was pretty common in the pre-release package of DenyHost v3.0 (available on gitHub), but I think it had been fixed in the final 3.0 release which is available through the website. Jesse |
From: Daniel S. <da...@ch...> - 2015-10-01 11:39:51
|
>>>>>> "DS" == Daniel Sutcliffe <da...@ch...> writes: > DS> I realized after I sent the above that the fact that systemd has > DS> become almost ubiquitous is making it harder and harder to support > DS> packages for EL6 and earlier and was thus am a lot less surprised > DS> than I was when I first found this discrepancy. On Wed, Sep 30, 2015 at 7:38 PM, Jason L Tibbitts III <ti...@ma...> wrote: > Well, initscripts aren't that hard. This is very true, but when they have been removed from the spec/src.rpm it makes the task more than the trivial tweaking and rebuilding. > It's more about me not being able to remember what ancient python > version is on which EL release, as well as having no way to actually test > the package. That is always the headache, made easier in these days of virtualization, but when it comes down to it there are just not enough hours in the day. > The Fedora package will be using python3 once I get it updated, which > cuts out EPEL (though EPEL7 does have some of python3 at this point). denyhosts 3 being focussed on python3 might explain the issue I am currently seeing, but it might also just be a dependency thing. The process runs for a bit and then falls over with some complaint about TupleType ... This is probably not the thread or the place to really discuss this though, this being the defunct denyhosts projects mailing list. Where is the active forum/list for discussions on the new GitHub/SFdenhost? > DS> I have just managed to produce a denyhosts-3.0-0.el6.noarch.rpm so > DS> soon enough I shall have a better idea if my original issues are > DS> going to be improved by this later version of denyhosts. > > Well, if you want to maintain denyhosts there, feel free to sign up. I > can click all of the necessary buttons to give you access. I have no problem making my specs and RPMs available publically, not sure how qualified they'll be to actually have them live in EPEL but lets getting a working RPM first and think about where the spec belongs later. I do welcome the opportunity to contribute to denyhosts and/or EPEL whatever. Back on topic: although my 3.0 install isn't exactly fully functional yet, I can already see that hosts-restricted is still getting 0 count entries for attempted logins that aren't anything to do with restricted-usernames - and checking the AGE_RESET_ bit of code I suspect is causing this does not seem to contain any changes... Let's continue this discussion in a more relevant place though, please advise, Cheers /dan -- Daniel Sutcliffe <da...@ch...> Chair Four Development Group LLC |
From: Jason L T. I. <ti...@ma...> - 2015-09-30 23:38:42
|
>>>>> "DS" == Daniel Sutcliffe <da...@ch...> writes: DS> I realized after I sent the above that the fact that systemd has DS> become almost ubiquitous is making it harder and harder to support DS> packages for EL6 and earlier and was thus am a lot less surprised DS> than I was when I first found this discrepancy. Well, initscripts aren't that hard. It's more about me not being able to remember what ancient python version is on which EL release, as well as having no way to actually test the package. The Fedora package will be using python3 once I get it updated, which cuts out EPEL (though EPEL7 does have some of python3 at this point). DS> I have just managed to produce a denyhosts-3.0-0.el6.noarch.rpm so DS> soon enough I shall have a better idea if my original issues are DS> going to be improved by this later version of denyhosts. Well, if you want to maintain denyhosts there, feel free to sign up. I can click all of the necessary buttons to give you access. - J< |
From: Jason L T. I. <ti...@ma...> - 2015-09-30 21:25:20
|
>>>>> "DS" == Daniel Sutcliffe <da...@ch...> writes: DS> On deeper investigation I see Fedora has packages from this newer DS> fork so I wonder why these have never found there way to EPEL. Because we don't just push things to EPEL; it's supposed to be stable. And while I maintain the Fedora packages, I avoid maintaining things for EPEL and so all I'll do is push an occasional security patch. I did push an update to EPEL7 because people asked nicely and the Fedora package would build there without modification, but that's not the case for EPEL6 (and the ancient EPEL5, which I avoid like the plague). - J< |
From: Daniel S. <da...@ch...> - 2015-09-30 20:54:49
|
Thanks for spending a little time to explain Jason, it is appreciated. >> "DS" == Daniel Sutcliffe <da...@ch...> writes: > DS> On deeper investigation I see Fedora has packages from this newer > DS> fork so I wonder why these have never found there way to EPEL. On Wed, Sep 30, 2015 at 4:28 PM, Jason L Tibbitts III <ti...@ma...> wrote: > Because we don't just push things to EPEL; it's supposed to be stable. I fully realize this, and was under no illusion that things "just got pushed" - in no way was this meant to be a dig at any maintainers as I understand all the work it takes to keep things stable and yet minimize the known problems. I realized after I sent the above that the fact that systemd has become almost ubiquitous is making it harder and harder to support packages for EL6 and earlier and was thus am a lot less surprised than I was when I first found this discrepancy. > And while I maintain the Fedora packages, I avoid maintaining things for > EPEL and so all I'll do is push an occasional security patch. I did > push an update to EPEL7 because people asked nicely and the Fedora > package would build there without modification, but that's not the case > for EPEL6 (and the ancient EPEL5, which I avoid like the plague). I unfortunately have the unenviable task of maintaining a number of EL6 servers (and even a couple of EL5) and I realize I probably have many hours ahead spent hacking .spec files whilst this situation continues :( I have just managed to produce a denyhosts-3.0-0.el6.noarch.rpm so soon enough I shall have a better idea if my original issues are going to be improved by this later version of denyhosts. Cheers /dan -- Daniel Sutcliffe <da...@ch...> Chair Four Development Group LLC |
From: Daniel S. <da...@ch...> - 2015-09-30 15:56:00
|
On Wed, Sep 30, 2015 at 9:00 AM, Jesse Smith <jes...@ya...> wrote: > I think that problem was addressed in the DenyHost fork of the project > last year, though I could be mistaken. Ah Joy, I was completely unaware of the fork - I was simply using the EL6 package from EPEL yum repository which looked like it was the latest (from initial investigation of this project) and even had some patches from earlier this year. On deeper investigation I see Fedora has packages from this newer fork so I wonder why these have never found there way to EPEL. Is it official this project has been put to pasture and being replaced by the fork? so many links still come to this project :( > Perhaps you could try v3.0 from the http://denyhost.sf.net website and report back > on whether you still encounter the problem? I will certainly give that a try and report back here. The other issue I was seeing was one reporting on this list earlier this year where some root attacks that showed up auth syslog with messages similar to: PAM {X} more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost={SUSP.NET.IP.ADDR} user=root : {MANY} time(s) were not getting banned. I guess I shall see if that gets fixed too. Cheers /dan > On 30/09/15 09:05 AM, Daniel Sutcliffe wrote: >> Firstly I'm a new subscriber so I must say I have been using DenyHosts >> for quite some time and have found it to be a really useful and simple >> to configure piece of software. >> >> I realize it hasn't been updated in quite some time but this probably >> just means it does exactly what is needed of it with little fuss or >> problems. >> >> Recently however I noticed a problem which caused me to look closer at >> what was going on - the initial problem is probably a config thing >> that I'll mention in a later email. The other issue I discovered that >> I mention in the subject line already seems to be in the bug database >> twice: >> https://sourceforge.net/p/denyhosts/bugs/32/ >> https://sourceforge.net/p/denyhosts/bugs/43/ >> Although, it seems the root of the problem has not been understood. >> >> I also came across the problem here: http://serverfault.com/q/647153/310481 >> >> What appears to be happening is that during LoginAttempt.add() in >> DenyHosts/loginattempt.py if any of the AGE_RESET_XXX configs are set >> and there is a valid host then .agg_count() gets called for the host >> in the specific __abusive_hosts_XXX set regardless of whether that >> host exists in that list or not. The result being a zero count entry >> for that host in a list it possibly does not really belong in. >> >> The downside to this seems only to be large hosts files and time >> wasted. Maybe there is a reason for this action, if so I'd love to >> have it explained before I attempt to fix this inefficiency and >> horribly break something else in a perfectly stable bit of code ;) -- Daniel Sutcliffe <da...@ch...> Chair Four Development Group LLC |
From: Jesse S. <jes...@ya...> - 2015-09-30 13:14:21
|
I think that problem was addressed in the DenyHost fork of the project last year, though I could be mistaken. Perhaps you could try v3.0 from the http://denyhost.sf.net website and report back on whether you still encounter the problem? Jesse On 30/09/15 09:05 AM, Daniel Sutcliffe wrote: > Firstly I'm a new subscriber so I must say I have been using DenyHosts > for quite some time and have found it to be a really useful and simple > to configure piece of software. > > I realize it hasn't been updated in quite some time but this probably > just means it does exactly what is needed of it with little fuss or > problems. > > Recently however I noticed a problem which caused me to look closer at > what was going on - the initial problem is probably a config thing > that I'll mention in a later email. The other issue I discovered that > I mention in the subject line already seems to be in the bug database > twice: > https://sourceforge.net/p/denyhosts/bugs/32/ > https://sourceforge.net/p/denyhosts/bugs/43/ > Although, it seems the root of the problem has not been understood. > > I also came across the problem here: http://serverfault.com/q/647153/310481 > > What appears to be happening is that during LoginAttempt.add() in > DenyHosts/loginattempt.py if any of the AGE_RESET_XXX configs are set > and there is a valid host then .agg_count() gets called for the host > in the specific __abusive_hosts_XXX set regardless of whether that > host exists in that list or not. The result being a zero count entry > for that host in a list it possibly does not really belong in. > > The downside to this seems only to be large hosts files and time > wasted. Maybe there is a reason for this action, if so I'd love to > have it explained before I attempt to fix this inefficiency and > horribly break something else in a perfectly stable bit of code ;) > > Cheers > /dan > |
From: Daniel S. <da...@ch...> - 2015-09-30 12:29:56
|
Firstly I'm a new subscriber so I must say I have been using DenyHosts for quite some time and have found it to be a really useful and simple to configure piece of software. I realize it hasn't been updated in quite some time but this probably just means it does exactly what is needed of it with little fuss or problems. Recently however I noticed a problem which caused me to look closer at what was going on - the initial problem is probably a config thing that I'll mention in a later email. The other issue I discovered that I mention in the subject line already seems to be in the bug database twice: https://sourceforge.net/p/denyhosts/bugs/32/ https://sourceforge.net/p/denyhosts/bugs/43/ Although, it seems the root of the problem has not been understood. I also came across the problem here: http://serverfault.com/q/647153/310481 What appears to be happening is that during LoginAttempt.add() in DenyHosts/loginattempt.py if any of the AGE_RESET_XXX configs are set and there is a valid host then .agg_count() gets called for the host in the specific __abusive_hosts_XXX set regardless of whether that host exists in that list or not. The result being a zero count entry for that host in a list it possibly does not really belong in. The downside to this seems only to be large hosts files and time wasted. Maybe there is a reason for this action, if so I'd love to have it explained before I attempt to fix this inefficiency and horribly break something else in a perfectly stable bit of code ;) Cheers /dan -- Daniel Sutcliffe <da...@ch...> Chair Four Development Group LLC |
From: Joseph G. <jg...@ha...> - 2015-08-03 18:10:22
|
Hi Jason, Thanks for the follow up... It was indeed the log file being huge :). The file is on a normal rotation cycle so it has since rotated to a compressed file for archiving. The system is quite a popular one in the hacker community, apparently, as the secure file can grow over 60 - 160 megs in a day HAH! Most of the systems I use Denyhosts on are smaller, less "known" hosts, so the secure file is like 5 - 10 megs and denyhosts fires right up, so it took me off guard. At this time, Denyhosts is working as it should. Thanks again!!! Joe Giles System Administrator HaloRiver Management Group jg...@ha... (w) 505-349-0380 (c) 505-225-4188 skype: joe-haloriver On Mon, Aug 3, 2015 at 12:02 PM, Jason L Tibbitts III <ti...@ma...> wrote: > >>>>> "JG" == Joseph Giles <jg...@ha...> writes: > > JG> I am using CentOS 6.6 fully updates and the following version of > JG> Denyhosts: > > JG> denyhosts-2.6-20.el6.noarch > > Unfortunately Centos6 is very old. (I know it's supported by Red Hat > but it was based off a Fedora so old that I can't remember what systems > and versions of things it actually has.) It looks like you're using the > EPEL package, which I have updated to fix security problems in the past > but which I don't really maintain because the modern packages don't even > build. If you use the regular EPEL support channel for assistance (see > below) I might be willing to cook up a package for a more recent > version. > > JG> I have it installed and configured to my liking, but when I do a > JG> service denyhosts start, it just sticks at: > > JG> /etc/init.d/denyhosts start Starting denyhosts: > > JG> And never comes back with OK. > > Didn't your package come with documentation which explains that? There > should be a README.Fedora file which explains this, though I guess that > package release may be old enough to not have it. I can't really > remember what's in those ancient releases. > > Anyway, the simple answer (assuming my guess about your problem is > correct) is to rotate /var/log/secure. Or just wait for denyhosts to > finish processing all of your old logs but I recommend the former. You > can manually process the rotated log later. > > Also, if you're going to use packages from some kind of distribution > like EPEL, it's probably best to file bugs for this kind of thing with > their support channel. For EPEL packages that would be > http://bugzilla.redhat.com > > - J< > -- The information (including any attachments) contained in this document is confidential and is for the use only of the intended recipient. If you are not the intended recipient, you should delete this message. Any distribution, disclosure, or copying of this message, or the taking of any action based on its contents is strictly prohibited. |
From: Jason L T. I. <ti...@ma...> - 2015-08-03 18:02:26
|
>>>>> "JG" == Joseph Giles <jg...@ha...> writes: JG> I am using CentOS 6.6 fully updates and the following version of JG> Denyhosts: JG> denyhosts-2.6-20.el6.noarch Unfortunately Centos6 is very old. (I know it's supported by Red Hat but it was based off a Fedora so old that I can't remember what systems and versions of things it actually has.) It looks like you're using the EPEL package, which I have updated to fix security problems in the past but which I don't really maintain because the modern packages don't even build. If you use the regular EPEL support channel for assistance (see below) I might be willing to cook up a package for a more recent version. JG> I have it installed and configured to my liking, but when I do a JG> service denyhosts start, it just sticks at: JG> /etc/init.d/denyhosts start Starting denyhosts: JG> And never comes back with OK. Didn't your package come with documentation which explains that? There should be a README.Fedora file which explains this, though I guess that package release may be old enough to not have it. I can't really remember what's in those ancient releases. Anyway, the simple answer (assuming my guess about your problem is correct) is to rotate /var/log/secure. Or just wait for denyhosts to finish processing all of your old logs but I recommend the former. You can manually process the rotated log later. Also, if you're going to use packages from some kind of distribution like EPEL, it's probably best to file bugs for this kind of thing with their support channel. For EPEL packages that would be http://bugzilla.redhat.com - J< |
From: Eike L. <zp...@gm...> - 2015-07-31 15:56:46
|
On Friday 31 July 2015 08:57:31 Joseph Giles wrote: > Hi List, > > I have been using Denyhosts for years, but this is the first time this has > happened to me, so I thought I would see if I can get some help. > > I have a VPS at Rackspace that I need to secure from ssh hacking attempts > and, as stated, have used denyhosts in the past on other systems. I am > using CentOS 6.6 fully updates and the following version of Denyhosts: > > denyhosts-2.6-20.el6.noarch Hi, Before going on beating a dead horse: Denyhosts 2.6 has been updated last in 2008. >From the OpenBSD 5.6 change-log: OpenSSH 6.7 Potentially-incompatible changes: sshd(8): Support for tcpwrappers/libwrap has been removed. Well, CentOS is another story but which version of OpenSSH does it use? Newer versions of Denyhosts are able to use pf tables and can do without libwrap. Is libwrap still available on your CentOS? Better go here https://github.com/denyhosts/denyhosts and install a recent version first. Then go on trouble checking. The project has been forked. Cheers Eike |
From: Joseph G. <jg...@ha...> - 2015-07-31 15:22:37
|
Hi List, I have been using Denyhosts for years, but this is the first time this has happened to me, so I thought I would see if I can get some help. I have a VPS at Rackspace that I need to secure from ssh hacking attempts and, as stated, have used denyhosts in the past on other systems. I am using CentOS 6.6 fully updates and the following version of Denyhosts: denyhosts-2.6-20.el6.noarch I have it installed and configured to my liking, but when I do a service denyhosts start, it just sticks at: /etc/init.d/denyhosts start Starting denyhosts: And never comes back with OK. I can see all the processes running and if I go to another shell, I can do a status on denyhosts and it shows its running: service denyhosts status denyhosts.py (pid 3267) is running... And ps aux shows the program churning: root 3260 0.0 0.0 106380 1780 pts/0 S+ 14:55 0:00 /bin/bash /etc/init.d/denyhosts start root 3266 0.0 0.0 106112 1184 pts/0 S+ 14:55 0:00 /bin/bash -c ulimit -S -c 0 >/dev/null 2>&1 ; /usr/bin/denyhosts.py --daemon --config=/etc/denyhosts.conf root 3267 99.2 0.2 189972 10116 pts/0 R+ 14:55 0:35 /usr/bin/python /usr/bin/denyhosts.py --daemon --config=/etc/denyhosts.conf root 3335 0.0 0.0 4124 308 ? S 14:55 0:00 sleep 60 But the init script never returns OK and I have to ctrl+c to exit. /etc/sysconfig/denyhosts has daemon set also: DAEMON=yes Any ideas on how to fix? Let me know if you need more information. Thanks! Joe Giles System Administrator HaloRiver Management Group -- The information (including any attachments) contained in this document is confidential and is for the use only of the intended recipient. If you are not the intended recipient, you should delete this message. Any distribution, disclosure, or copying of this message, or the taking of any action based on its contents is strictly prohibited. |
From: Jason L T. I. <ti...@ma...> - 2015-07-16 01:03:30
|
Well, hmm, I guess I let Fedora get a bit too old because the release branches are still on 2.9 and there's weirdness with SYNC_PROXY_SERVER: 2015-07-15 18:56:15,567 - sync : ERROR 'SYNC_PROXY_SERVER' 2015-07-15 18:56:15,567 - sync : ERROR Could not initiate xmlrpc connection That isn't even in later versions and only appears at one point in the source so I'm not even sure what it wants. I'll just edit it out and should probably patch it out of the Fedora version for now. I really need to get back to working on denyhosts again. - J< |
From: Jean-Marc S. <jea...@sp...> - 2015-07-15 23:50:28
|
Thanks Jesse. Make a lot of sense. I will most probably give that a try too!!! JM 2015-07-15 18:55 GMT-04:00 Jesse Smith <jes...@ya...>: > Short answer: Jan-Pascal is a better person to answer this question, but > he has put anti-malicious behaviour checks in place. > > Somewhat longer answer: DenyHosts will allow you to set a check which > basically says "Only block this host if N number of people have said we > should." The variable in the DenyHosts configuration file is called > "SYNC_DOWNLOAD_THRESHOLD ". In other words, if one malicious person > spams random IP addresses into our database, that should not be a > problem so long as SYNC_DOWNLOAD_THRESHOLD is set to higher than 1. > > I would recommend setting SYNC_DOWNLOAD_THRESHOLD to 3 or higher as it > will protect you from multiple malicious people trying to poison our > database. > > Jesse > > > > > On 15/07/15 07:46 PM, Jean-Marc Spaggiari wrote: > > Nice initiative. Thanks for doing that. > > > > Is ther any thing in place to avoid baf behaviors like people reporting > > random IPs etc.? > > > > Like, how trustful will be this list? > > > > Le 2015-07-15 18:17, "Jesse Smith" <jes...@ya... > > <mailto:jes...@ya...>> a écrit : > > > > The test server Jan-Pascal mentioned is now up and running. We're > hoping > > to see how well it holds up with a small group of users, so if you're > > interested, please edit your DenyHosts configuration files and set > the > > SYNC_SERVER to http://deny.resonatingmedia.com:9911 > > > > Assuming the trial goes well, we will leave the sync server running > and > > announce it more publicly. > > > > A big "Thank You!" to Jan-Pascal for writing the server-side code and > > putting so much work into helping us test it and improve both client > > side and server side. > > > > Jesse > > > > > > > > > > On 15/07/15 06:47 PM, Robert T Wyatt wrote: > > > THANK YOU! > > > > > > --Robert Wyatt > > > Austin, TX > > > > > > > > > Jan-Pascal van Best wrote: > > >> Hi all, > > >> > > >> For several years now users of DenyHosts have been asking for an > open > > >> source synchronization server, a central hub that would allow > > DenyHosts > > >> to coordinate and share malicious IP addresses. This has gotten > more > > >> urgent due to a number of serious flaws in the current > > synchronization > > >> server[1] and the lack of response from the original DenyHosts > > developer. > > >> > > >> I've created, in full cooperation with the current DenyHosts > > >> developers[2], an open source (AGPLv3) synchronization server > > [3]. The > > >> server has been working well in our initial tests and since it > > has just > > >> reached release 1.0 we will shortly invite a wider group of > people to > > >> use the new server. Initially there will be fewer reports from > > the new > > >> sync server than you now receive from the legacy server, but we > are > > >> convinced that the quality of the synchronization algorithm is > higher > > >> and that, once enough people connect to the new server, it will > > better > > >> serve the denyhosts community. Once created, the address of the > > new sync > > >> server will we announced at > http://denyhost.sourceforge.net/news.php. > > >> > > >> I'd be happy to answer any questions you may have regarding the > > new sync > > >> server and the circumstances that led to its development. > > >> > > >> Kind regards > > >> > > >> Jan-Pascal > > >> > > >> > > >> [1] http://sourceforge.net/p/denyhosts/bugs/53/ > > >> [2] https://github.com/denyhosts/denyhosts/issues/35 > > >> [3] https://github.com/janpascal/denyhosts_sync > > >> > > >> > > >> > > >> > > > ------------------------------------------------------------------------------ > > >> Don't Limit Your Business. Reach for the Cloud. > > >> GigeNET's Cloud Solutions provide you with the tools and support > that > > >> you need to offload your IT needs and focus on growing your > business. > > >> Configured For All Businesses. Start Your Cloud Today. > > >> https://www.gigenetcloud.com/ > > >> _______________________________________________ > > >> Denyhosts-user mailing list > > >> Den...@li... > > <mailto:Den...@li...> > > >> https://lists.sourceforge.net/lists/listinfo/denyhosts-user > > > > > > > > > > > > ------------------------------------------------------------------------------ > > > Don't Limit Your Business. Reach for the Cloud. > > > GigeNET's Cloud Solutions provide you with the tools and support > that > > > you need to offload your IT needs and focus on growing your > business. > > > Configured For All Businesses. Start Your Cloud Today. > > > https://www.gigenetcloud.com/ > > > _______________________________________________ > > > Denyhosts-user mailing list > > > Den...@li... > > <mailto:Den...@li...> > > > https://lists.sourceforge.net/lists/listinfo/denyhosts-user > > > > > > > > > > ------------------------------------------------------------------------------ > > Don't Limit Your Business. Reach for the Cloud. > > GigeNET's Cloud Solutions provide you with the tools and support that > > you need to offload your IT needs and focus on growing your business. > > Configured For All Businesses. Start Your Cloud Today. > > https://www.gigenetcloud.com/ > > _______________________________________________ > > Denyhosts-user mailing list > > Den...@li... > > <mailto:Den...@li...> > > https://lists.sourceforge.net/lists/listinfo/denyhosts-user > > > > |