Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm securing my ssh server with DenyHosts, and decided to dig into DenyHosts' configuration to make sure things looked good. There's an option called SERVER_SYNC, that makes an xmlrpc call and seems to crowdsource securing an SSH server by using denyhosts' central server to collect statistics about bad hosts.

I'm intrigued by the idea, but before making such a drastic change I wanted to know, are other people using this? If so, please write a little about your experience with the SYNC_SERVER option in DenyHosts and any issues I should watch for. Thanks.

share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

I certainly am using it.

It works as you'd expect it to and it is probably denyhosts best feature.

I have a bunch of servers each one is set up using

SYNC_SERVER = http://xmlrpc.denyhosts.net:9911 
SYNC_INTERVAL = 1h
SYNC_UPLOAD = YES
SYNC_DOWNLOAD = YES

The reason that this is so awesome is that an attack starts on one server, which causes that IP address to be blocked on all of our servers. So by the time the attacker gets around to the other servers he is already blocked before the attack starts.

Make sure you add at least one good IP address to you allowed-hosts file and then start using it.

Details of what IP addresses are being blocked using the synchronisation, can be found in the file "sync-received".

I have not found, and I cannot think of, any downside to using this.

share|improve this answer
    
thanks for your feedback Richard. i started using this a few days ago, as it does sound like a really smart way of dealing with brute forcing. so far it seems like a really stable service, and i'm thoroughly impressed. –  nathwill Oct 21 '10 at 14:51
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.