21

While doing a test-upgrade of our Ubuntu server to 14.04, I found that the package DenyHosts is no longer available. Installing it gives following error:

apt-get install denyhosts
Reading package lists... Done
Building dependency tree       
Reading state information... Done
E: Unable to locate package denyhosts

Apparently it has been deleted, according to launchpad.

Will Denyhosts be available in the final release of Ubuntu 14.04?

  • 1
    You did run apt-get update before the install command right? – Seth Mar 13 '14 at 21:03
  • Looks like it is/was in trusty-proposed, but a couple of the open bugs look to be "doesn't conform to filesystem standards" things. So, while I don't know, someone may have been pushing to get it from ppa to repo and failed because of the filesystem conformity issues. – RobotHumans Mar 13 '14 at 21:08
  • +1 --- denyhosts is an important piece of software for me. It has marked as unmaintained, which is quite important for a piece of software about security. So it needs to be adopted... or we will have to resort to the source. – Rmano Mar 13 '14 at 21:13
  • 4
    I think you answered your own question : "dead upstream; unmaintained; dysfunctional in sid". Unmaintained upstream projects will reside in the repos, with patches, until the packages can no longer patch, so looks like the end for denyhosts. There are many alternates, including iptables see bodhizazen.net/Tutorials/iptables#Additional_Tips . scroll down just a bit to "Use iptables to reject/block failed connections" – Panther Mar 13 '14 at 21:15
  • 3
    @Rmano - I am sorry denyhosts has reached this stage, look at my link, fail2ban, several alternates to denyhosts. See also bodhizazen.net/Tutorials/SSH_security – Panther Mar 13 '14 at 21:17
19

I am sorry denyhosts has reached this stage, but I think you answered your own question :

dead upstream; unmaintained; dysfunctional in sid

Unmaintained upstream projects will reside in the repos, with patches, until the packages can no longer patch, so looks like the end for denyhosts.

My best advice is to look for alternates.

Personally I harden my ssh server

And use iptables

sudo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH --rsource -j ACCEPT
sudo iptables -A INPUT -m recent --update --seconds 600 --hitcount 8 --rttl --name SSH --rsource -j DROP 

See http://bodhizazen.com/Tutorials/iptables

all the links in this post are from my LUG ;)

  • Thanks, will look into iptables and fail2ban as a replacement. – Kees van Dieren Mar 13 '14 at 21:26
  • good luck to you, those iptables rules I gave you are a nice option and do not require any additional packages. You can be more strict, but the rules are sufficient for all but the most persistent script kiddies – Panther Mar 13 '14 at 21:28
  • I will test iptable rules. My problem is that this will limit repeated connections, not just failed attempts --- and using unison to sync my files will mean that I will sometime do a LOT of (good) connections. Or I am wrong? Will look at fail2ban... – Rmano Mar 14 '14 at 0:03
  • @rmano You can add a rule before these ones that allows port 22 for a specific IP, and as long as you run Unison from that IP then it won't have issues. – William Lawn Stewart Mar 14 '14 at 3:44
  • 1
    @WilliamLawnStewart ...this is almost impossible, I have no fixed ip; I do that from anywhere I am. Fail2ban seems that will work ok, is based on the same principle of denyhosts. – Rmano Mar 14 '14 at 4:11
8

No, it's not comming back. bodhi offers some good suggestion on how you can replace it, but it's also worth explaining why it was remove.

It was removed in Debian at the request of the Debian Security Team:

  • There are unaddressed security issues (e.g. #692229).
  • The tool is dead upstream (last release 2008).
  • There is a viable alternative, fail2ban, that provides the same or increased feature set.

You might also want to check out this question on ServerFault:

Denyhosts vs fail2ban vs iptables- best way to prevent brute force logons?

  • I mostly posted this to test my Ubuntu Touch app's, StackBrowser, new ability to post answers. I can deleted it if people think it's not significantly different from bodhi's. – andrewsomething Mar 13 '14 at 21:45
  • 3
    Don't delete it --- it has useful links. Thanks. – Rmano Mar 13 '14 at 23:56
4

While DenyHosts is not available as a package in Ubuntu, there is a fork of the upstream project here: http://denyhost.sf.net The fork includes security patches and better supports Ubuntu. You can install it by downloading the tarball and running

tar xzf denyhost-2.7.tar.gz
cd DenyHosts-2.7
sudo python setup.py install
  • Ok I see this 2.7 link is kind of hidden compared to the rest of the denyhosts downloads (which were all 2.6 ~2008). I was getting confused - note denyhost and denyhosts in the URL – Jeremy Hajek May 21 '14 at 5:09
  • Nice! Copy /usr/local/bin/daemon-control-dist to /etc/init.d/denyhosts after installing and change one path in that file: DENYHOSTS_BIN = "/usr/local/bin/denyhosts.py" – neu242 May 23 '14 at 19:31
0

It is unmaintained, but issue #692229 is fixed, as noted here https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=692229

Fail2ban isn't really an alternative if you want to use a sync server. I haven't seen other systems than denyhosts that support this.

So, as long as it works, why not use it?

-1

It appears that a fork is now being maintained at https://github.com/denyhosts/denyhosts and the current version is 2.9.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.