While doing a test-upgrade of our Ubuntu server to 14.04, I found that the package DenyHosts is no longer available. Installing it gives following error:

apt-get install denyhosts
Reading package lists... Done
Building dependency tree       
Reading state information... Done
E: Unable to locate package denyhosts

Apparently it has been deleted, according to launchpad.

Will Denyhosts be available in the final release of Ubuntu 14.04?

  • 1
    You did run apt-get update before the install command right?
    – Seth
    Mar 13, 2014 at 21:03
  • Looks like it is/was in trusty-proposed, but a couple of the open bugs look to be "doesn't conform to filesystem standards" things. So, while I don't know, someone may have been pushing to get it from ppa to repo and failed because of the filesystem conformity issues. Mar 13, 2014 at 21:08
  • +1 --- denyhosts is an important piece of software for me. It has marked as unmaintained, which is quite important for a piece of software about security. So it needs to be adopted... or we will have to resort to the source.
    – Rmano
    Mar 13, 2014 at 21:13
  • 4
    I think you answered your own question : "dead upstream; unmaintained; dysfunctional in sid". Unmaintained upstream projects will reside in the repos, with patches, until the packages can no longer patch, so looks like the end for denyhosts. There are many alternates, including iptables see bodhizazen.net/Tutorials/iptables#Additional_Tips . scroll down just a bit to "Use iptables to reject/block failed connections"
    – Panther
    Mar 13, 2014 at 21:15
  • 3
    @Rmano - I am sorry denyhosts has reached this stage, look at my link, fail2ban, several alternates to denyhosts. See also bodhizazen.net/Tutorials/SSH_security
    – Panther
    Mar 13, 2014 at 21:17

5 Answers 5


I am sorry denyhosts has reached this stage, but I think you answered your own question :

dead upstream; unmaintained; dysfunctional in sid

Unmaintained upstream projects will reside in the repos, with patches, until the packages can no longer patch, so looks like the end for denyhosts.

My best advice is to look for alternates.

Personally I harden my ssh server

And use iptables

sudo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH --rsource -j ACCEPT
sudo iptables -A INPUT -m recent --update --seconds 600 --hitcount 8 --rttl --name SSH --rsource -j DROP 

See http://bodhizazen.com/Tutorials/iptables

all the links in this post are from my LUG ;)

  • Thanks, will look into iptables and fail2ban as a replacement. Mar 13, 2014 at 21:26
  • good luck to you, those iptables rules I gave you are a nice option and do not require any additional packages. You can be more strict, but the rules are sufficient for all but the most persistent script kiddies
    – Panther
    Mar 13, 2014 at 21:28
  • I will test iptable rules. My problem is that this will limit repeated connections, not just failed attempts --- and using unison to sync my files will mean that I will sometime do a LOT of (good) connections. Or I am wrong? Will look at fail2ban...
    – Rmano
    Mar 14, 2014 at 0:03
  • @rmano You can add a rule before these ones that allows port 22 for a specific IP, and as long as you run Unison from that IP then it won't have issues. Mar 14, 2014 at 3:44
  • 1
    @WilliamLawnStewart ...this is almost impossible, I have no fixed ip; I do that from anywhere I am. Fail2ban seems that will work ok, is based on the same principle of denyhosts.
    – Rmano
    Mar 14, 2014 at 4:11

No, it's not comming back. bodhi offers some good suggestion on how you can replace it, but it's also worth explaining why it was remove.

It was removed in Debian at the request of the Debian Security Team:

  • There are unaddressed security issues (e.g. #692229).
  • The tool is dead upstream (last release 2008).
  • There is a viable alternative, fail2ban, that provides the same or increased feature set.

You might also want to check out this question on ServerFault:

Denyhosts vs fail2ban vs iptables- best way to prevent brute force logons?

  • I mostly posted this to test my Ubuntu Touch app's, StackBrowser, new ability to post answers. I can deleted it if people think it's not significantly different from bodhi's. Mar 13, 2014 at 21:45
  • 3
    Don't delete it --- it has useful links. Thanks.
    – Rmano
    Mar 13, 2014 at 23:56

While DenyHosts is not available as a package in Ubuntu, there is a fork of the upstream project here: http://denyhost.sf.net The fork includes security patches and better supports Ubuntu. You can install it by downloading the tarball and running

tar xzf denyhost-2.7.tar.gz
cd DenyHosts-2.7
sudo python setup.py install
  • Ok I see this 2.7 link is kind of hidden compared to the rest of the denyhosts downloads (which were all 2.6 ~2008). I was getting confused - note denyhost and denyhosts in the URL May 21, 2014 at 5:09
  • Nice! Copy /usr/local/bin/daemon-control-dist to /etc/init.d/denyhosts after installing and change one path in that file: DENYHOSTS_BIN = "/usr/local/bin/denyhosts.py"
    – neu242
    May 23, 2014 at 19:31

It is unmaintained, but issue #692229 is fixed, as noted here https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=692229

Fail2ban isn't really an alternative if you want to use a sync server. I haven't seen other systems than denyhosts that support this.

So, as long as it works, why not use it?


It appears that a fork is now being maintained at https://github.com/denyhosts/denyhosts and the current version is 2.9.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .