我在/etc/hosts.deny文件中有以下内容
# # hosts.deny This file describes the names of the hosts which are # *not* allowed to use the local INET services, as decided # by the '/usr/sbin/tcpd' server. # # The portmap line is redundant, but it is left to remind you that # the new secure portmap uses hosts.deny and hosts.allow. In particular # you should know that NFS uses portmap! ALL:ALL 这在/etc/hosts.allow中
# # hosts.allow This file describes the names of the hosts which are # allowed to use the local INET services, as decided # by the '/usr/sbin/tcpd' server. # ALL:xx.xx.xx.xx , xx.xx.xxx.xx , xx.xx.xxx.xxx , xx.x.xxx.xxx , xx.xxx.xxx.xxx
但我仍然收到很多这些电子邮件：
Time: Thu Feb 10 13:39:55 2011 +0000 IP: 202.119.208.220 (CN/China/-) Failures: 5 (sshd) Interval: 300 seconds Blocked: Permanent Block Log entries: Feb 10 13:39:52 ds-103 sshd[12566]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.119.208.220 user=root Feb 10 13:39:52 ds-103 sshd[12567]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.119.208.220 user=root Feb 10 13:39:52 ds-103 sshd[12568]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.119.208.220 user=root Feb 10 13:39:52 ds-103 sshd[12571]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.119.208.220 user=root Feb 10 13:39:53 ds-103 sshd[12575]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.119.208.220 user=root
更糟糕的是CSF试图自动阻止这些IP的时候尝试进入，但虽然它把IP的CSF.deny文件，他们也不会被阻止
所以我试图用/etc/hosts.deny来阻止所有的ip，并且只允许ip和/etc/hosts.allow一起使用，但是到目前为止它似乎没有工作。
现在我不得不手动阻止每一个与iptables，我宁愿它会自动阻止黑客的情况下，我离开一台电脑或睡着了
改变了这个文件，现在它似乎工作。
几个小时内就能知道这个解决不了的
# # hosts.deny This file describes the names of the hosts which are # *not* allowed to use the local INET services, as decided # by the '/usr/sbin/tcpd' server. # # The portmap line is redundant, but it is left to remind you that # the new secure portmap uses hosts.deny and hosts.allow. In particular # you should know that NFS uses portmap! ALL: ALL
看起来冒号后面需要一个空格。
# # hosts.allow This file describes the names of the hosts which are # allowed to use the local INET services, as decided # by the '/usr/sbin/tcpd' server. ALL: xx.xxx.xx.xx , xx.xxx.xxx.xx , xx.xx.xxx.xxx , xx.x.xxx.xxx , xx.xxx.xxx.xxx
尝试在/etc/hosts.deny中明确地设置sshd deamon
sshd: ALL
和/etc/hosts.allow中
sshd: .example.com xxx.xxx.xxx.xxx
这总是适合我。
您也可以将AllowUsers设置为允许的用户和IP。
为了让我的生活更轻松，我还做了一些第二个sshd来连接外部连接，监听一个不同于默认的ssh端口22的端口。 这种方式很多尝试甚至没有达到我的日志。 它根本不提高安全性，有些脚本可能会扫描所有的端口，find真正的端口，但大多数只扫描默认的端口22.这样我的日志文件就不会满足这个噪音。
我也使用/ etc / hosts.deny和/ etc / hosts.allow sshd，它在这里完美。 您的系统世界中的这些文件是否可读？