Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm securing my ssh server with DenyHosts, and decided to dig into DenyHosts' configuration to make sure things looked good. There's an option called SERVER_SYNC, that makes an xmlrpc call and seems to crowdsource securing an SSH server by using denyhosts' central server to collect statistics about bad hosts.

I'm intrigued by the idea, but before making such a drastic change I wanted to know, are other people using this? If so, please write a little about your experience with the SYNC_SERVER option in DenyHosts and any issues I should watch for. Thanks.

share|improve this question
up vote 1 down vote accepted

I certainly am using it.

It works as you'd expect it to and it is probably denyhosts best feature.

I have a bunch of servers each one is set up using


The reason that this is so awesome is that an attack starts on one server, which causes that IP address to be blocked on all of our servers. So by the time the attacker gets around to the other servers he is already blocked before the attack starts.

Make sure you add at least one good IP address to you allowed-hosts file and then start using it.

Details of what IP addresses are being blocked using the synchronisation, can be found in the file "sync-received".

I have not found, and I cannot think of, any downside to using this.

share|improve this answer
thanks for your feedback Richard. i started using this a few days ago, as it does sound like a really smart way of dealing with brute forcing. so far it seems like a really stable service, and i'm thoroughly impressed. – nathwill Oct 21 '10 at 14:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.