Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

While doing a test-upgrade of our Ubuntu server to 14.04, I found that the package DenyHosts is no longer available. Installing it gives following error:

apt-get install denyhosts
Reading package lists... Done
Building dependency tree       
Reading state information... Done
E: Unable to locate package denyhosts

Apparently it has been deleted, according to launchpad.

Will Denyhosts be available in the final release of Ubuntu 14.04?

share|improve this question
You did run apt-get update before the install command right? – Seth Mar 13 '14 at 21:03
Looks like it is/was in trusty-proposed, but a couple of the open bugs look to be "doesn't conform to filesystem standards" things. So, while I don't know, someone may have been pushing to get it from ppa to repo and failed because of the filesystem conformity issues. – RobotHumans Mar 13 '14 at 21:08
+1 --- denyhosts is an important piece of software for me. It has marked as unmaintained, which is quite important for a piece of software about security. So it needs to be adopted... or we will have to resort to the source. – Rmano Mar 13 '14 at 21:13
I think you answered your own question : "dead upstream; unmaintained; dysfunctional in sid". Unmaintained upstream projects will reside in the repos, with patches, until the packages can no longer patch, so looks like the end for denyhosts. There are many alternates, including iptables see . scroll down just a bit to "Use iptables to reject/block failed connections" – bodhi.zazen Mar 13 '14 at 21:15
@Rmano - I am sorry denyhosts has reached this stage, look at my link, fail2ban, several alternates to denyhosts. See also – bodhi.zazen Mar 13 '14 at 21:17
up vote 16 down vote accepted

I am sorry denyhosts has reached this stage, but I think you answered your own question :

dead upstream; unmaintained; dysfunctional in sid

Unmaintained upstream projects will reside in the repos, with patches, until the packages can no longer patch, so looks like the end for denyhosts.

My best advice is to look for alternates.

Personally I harden my ssh server

And use iptables

sudo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH --rsource -j ACCEPT
sudo iptables -A INPUT -m recent --update --seconds 600 --hitcount 8 --rttl --name SSH --rsource -j DROP 


all the links in this post are from my LUG ;)

share|improve this answer
Thanks, will look into iptables and fail2ban as a replacement. – Kees van Dieren Mar 13 '14 at 21:26
good luck to you, those iptables rules I gave you are a nice option and do not require any additional packages. You can be more strict, but the rules are sufficient for all but the most persistent script kiddies – bodhi.zazen Mar 13 '14 at 21:28
I will test iptable rules. My problem is that this will limit repeated connections, not just failed attempts --- and using unison to sync my files will mean that I will sometime do a LOT of (good) connections. Or I am wrong? Will look at fail2ban... – Rmano Mar 14 '14 at 0:03
@rmano You can add a rule before these ones that allows port 22 for a specific IP, and as long as you run Unison from that IP then it won't have issues. – William Lawn Stewart Mar 14 '14 at 3:44
@WilliamLawnStewart ...this is almost impossible, I have no fixed ip; I do that from anywhere I am. Fail2ban seems that will work ok, is based on the same principle of denyhosts. – Rmano Mar 14 '14 at 4:11

No, it's not comming back. bodhi offers some good suggestion on how you can replace it, but it's also worth explaining why it was remove.

It was removed in Debian at the request of the Debian Security Team:

  • There are unaddressed security issues (e.g. #692229).
  • The tool is dead upstream (last release 2008).
  • There is a viable alternative, fail2ban, that provides the same or increased feature set.

You might also want to check out this question on ServerFault:

Denyhosts vs fail2ban vs iptables- best way to prevent brute force logons?

share|improve this answer
I mostly posted this to test my Ubuntu Touch app's, StackBrowser, new ability to post answers. I can deleted it if people think it's not significantly different from bodhi's. – andrewsomething Mar 13 '14 at 21:45
Don't delete it --- it has useful links. Thanks. – Rmano Mar 13 '14 at 23:56

While DenyHosts is not available as a package in Ubuntu, there is a fork of the upstream project here: The fork includes security patches and better supports Ubuntu. You can install it by downloading the tarball and running

tar xzf denyhost-2.7.tar.gz
cd DenyHosts-2.7
sudo python install
share|improve this answer
Ok I see this 2.7 link is kind of hidden compared to the rest of the denyhosts downloads (which were all 2.6 ~2008). I was getting confused - note denyhost and denyhosts in the URL – Jeremy Hajek May 21 '14 at 5:09
Nice! Copy /usr/local/bin/daemon-control-dist to /etc/init.d/denyhosts after installing and change one path in that file: DENYHOSTS_BIN = "/usr/local/bin/" – neu242 May 23 '14 at 19:31

It is unmaintained, but issue #692229 is fixed, as noted here

Fail2ban isn't really an alternative if you want to use a sync server. I haven't seen other systems than denyhosts that support this.

So, as long as it works, why not use it?

share|improve this answer

It appears that a fork is now being maintained at and the current version is 2.9.

share|improve this answer
While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. – David Foerster Feb 14 '15 at 13:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.