Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

While doing a test-upgrade of our Ubuntu server to 14.04, I found that the package DenyHosts is no longer available. Installing it gives following error:

apt-get install denyhosts
Reading package lists... Done
Building dependency tree       
Reading state information... Done
E: Unable to locate package denyhosts

Apparently it has been deleted, according to launchpad.

Will Denyhosts be available in the final release of Ubuntu 14.04?

share|improve this question
1  
You did run apt-get update before the install command right? –  Seth Mar 13 at 21:03
    
Looks like it is/was in trusty-proposed, but a couple of the open bugs look to be "doesn't conform to filesystem standards" things. So, while I don't know, someone may have been pushing to get it from ppa to repo and failed because of the filesystem conformity issues. –  hbdgaf Mar 13 at 21:08
    
+1 --- denyhosts is an important piece of software for me. It has marked as unmaintained, which is quite important for a piece of software about security. So it needs to be adopted... or we will have to resort to the source. –  Rmano Mar 13 at 21:13
4  
I think you answered your own question : "dead upstream; unmaintained; dysfunctional in sid". Unmaintained upstream projects will reside in the repos, with patches, until the packages can no longer patch, so looks like the end for denyhosts. There are many alternates, including iptables see bodhizazen.net/Tutorials/iptables#Additional_Tips . scroll down just a bit to "Use iptables to reject/block failed connections" –  bodhi.zazen Mar 13 at 21:15
3  
@Rmano - I am sorry denyhosts has reached this stage, look at my link, fail2ban, several alternates to denyhosts. See also bodhizazen.net/Tutorials/SSH_security –  bodhi.zazen Mar 13 at 21:17

4 Answers 4

up vote 10 down vote accepted

I am sorry denyhosts has reached this stage, but I think you answered your own question :

dead upstream; unmaintained; dysfunctional in sid

Unmaintained upstream projects will reside in the repos, with patches, until the packages can no longer patch, so looks like the end for denyhosts.

My best advice is to look for alternates.

Personally I harden my ssh server

And use iptables

sudo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH --rsource -j ACCEPT
sudo iptables -A INPUT -m recent --update --seconds 600 --hitcount 8 --rttl --name SSH --rsource -j DROP 

See http://bodhizazen.net/Tutorials/iptables

all the links in this post are from my LUG ;)

share|improve this answer
    
Thanks, will look into iptables and fail2ban as a replacement. –  Kees van Dieren Mar 13 at 21:26
    
good luck to you, those iptables rules I gave you are a nice option and do not require any additional packages. You can be more strict, but the rules are sufficient for all but the most persistent script kiddies –  bodhi.zazen Mar 13 at 21:28
    
I will test iptable rules. My problem is that this will limit repeated connections, not just failed attempts --- and using unison to sync my files will mean that I will sometime do a LOT of (good) connections. Or I am wrong? Will look at fail2ban... –  Rmano Mar 14 at 0:03
    
@rmano You can add a rule before these ones that allows port 22 for a specific IP, and as long as you run Unison from that IP then it won't have issues. –  William Lawn Stewart Mar 14 at 3:44
1  
@WilliamLawnStewart ...this is almost impossible, I have no fixed ip; I do that from anywhere I am. Fail2ban seems that will work ok, is based on the same principle of denyhosts. –  Rmano Mar 14 at 4:11

No, it's not comming back. bodhi offers some good suggestion on how you can replace it, but it's also worth explaining why it was remove.

It was removed in Debian at the request of the Debian Security Team:

  • There are unaddressed security issues (e.g. #692229).
  • The tool is dead upstream (last release 2008).
  • There is a viable alternative, fail2ban, that provides the same or increased feature set.

You might also want to check out this question on ServerFault:

Denyhosts vs fail2ban vs iptables- best way to prevent brute force logons?

share|improve this answer
    
I mostly posted this to test my Ubuntu Touch app's, StackBrowser, new ability to post answers. I can deleted it if people think it's not significantly different from bodhi's. –  andrewsomething Mar 13 at 21:45
3  
Don't delete it --- it has useful links. Thanks. –  Rmano Mar 13 at 23:56

While DenyHosts is not available as a package in Ubuntu, there is a fork of the upstream project here: http://denyhost.sf.net The fork includes security patches and better supports Ubuntu. You can install it by downloading the tarball and running

tar xzf denyhost-2.7.tar.gz
cd DenyHosts-2.7
sudo python setup.py install
share|improve this answer
    
Ok I see this 2.7 link is kind of hidden compared to the rest of the denyhosts downloads (which were all 2.6 ~2008). I was getting confused - note denyhost and denyhosts in the URL –  Jeremy Hajek May 21 at 5:09
    
Nice! Copy /usr/local/bin/daemon-control-dist to /etc/init.d/denyhosts after installing and change one path in that file: DENYHOSTS_BIN = "/usr/local/bin/denyhosts.py" –  neu242 May 23 at 19:31

It is unmaintained, but issue #692229 is fixed, as noted here https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=692229

Fail2ban isn't really an alternative if you want to use a sync server. I haven't seen other systems than denyhosts that support this.

So, as long as it works, why not use it?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.