1

I'm securing my ssh server with DenyHosts, and decided to dig into DenyHosts' configuration to make sure things looked good. There's an option called SERVER_SYNC, that makes an xmlrpc call and seems to crowdsource securing an SSH server by using denyhosts' central server to collect statistics about bad hosts.

I'm intrigued by the idea, but before making such a drastic change I wanted to know, are other people using this? If so, please write a little about your experience with the SYNC_SERVER option in DenyHosts and any issues I should watch for. Thanks.

Improve this question
1

I certainly am using it.

It works as you'd expect it to and it is probably denyhosts best feature.

I have a bunch of servers each one is set up using 

SYNC_SERVER = http://xmlrpc.denyhosts.net:9911 
SYNC_INTERVAL = 1h
SYNC_UPLOAD = YES
SYNC_DOWNLOAD = YES

The reason that this is so awesome is that an attack starts on one server, which causes that IP address to be blocked on all of our servers. So by the time the attacker gets around to the other servers he is already blocked before the attack starts.

Make sure you add at least one good IP address to you allowed-hosts file and then start using it.

Details of what IP addresses are being blocked using the synchronisation, can be found in the file "sync-received".

I have not found, and I cannot think of, any downside to using this.

Improve this answer
1
  • thanks for your feedback Richard. i started using this a few days ago, as it does sound like a really smart way of dealing with brute forcing. so far it seems like a really stable service, and i'm thoroughly impressed. – nathwill Oct 21 '10 at 14:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.