Prevent SSH Brute Force Attack with Denyhosts on FreeBSD

Sometime our machine get error about error login from log message on SSHD services. Maybe, our machine has been attached by someone with brute force SSH method. We can use firewall to prevent SSH brute force attack, or we can use sshguard, sshdfilter, or denyhosts to block brute force. This tools will block SSH brute force attack automatically. In here, I will use denyhosts to prevent SSH brute force on my machine.

To install denyhosts quickly we can use ports from our FreeBSD.

# cd /usr/ports/security/denyhosts
#make install clean

You will have to follow the installation steps provided after the denyhosts install is completed.I post them here for clarity:

-------------------------------------------------------------------------------
To run denyhosts from startup, add denyhosts_enable="YES"
in your /etc/rc.conf.
Configiration options can be found in /usr/local/etc/denyhosts.conf
-------------------------------------------------------------------------------
In order to proper working of denyhosts
1. edit your /etc/hosts.allow file and add:
sshd : /etc/hosts.deniedssh : deny
sshd : ALL : allow
2. issue the following command if /etc/hosts.deniedssh does not exist yet
touch /etc/hosts.deniedssh
-------------------------------------------------------------------------------
Warning:

syslogd should ideally be run with the -c option; this will ensure that
denyhosts notices multiple repeated login attempts.

To do this, add syslogd_flags="-c" to /etc/rc.conf
-------------------------------------------------------------------------------

Having the above instructions in mind to finalize the installation, you will have to issue.

# echo 'denyhosts_enable="YES"' >> /etc/rc.conf
# echo 'syslogd_flags="-c"' >> /etc/rc.conf

Now edit "/usr/local/etc/denyhosts.conf" and make sure in it you edit the variables HOSTS_DENY and BLOCK_SERVICE
The two variables should be set to the values like the shown below:

...
HOSTS_DENY = /etc/hosts.deniedssh
BLOCK_SERVICE = sshd
...

Now edit "/etc/hosts.allow" and include the directives:

...
sshd: /etc/hosts.deniedssh: deny
sshd: ALL : allow
...

If you install with remote the FreeBSD machine, to prevent you locked by FreeBSD machine "if" something wrong, just add :

sshd : yourip : allow

after "sshd: ALL : allow". Please change "yourip" with your machine IP, example 192.168.0.2.

This should have completed denyhosts configuration, and we need to further create the "/etc/hosts.deniedssh" file.

# touch /etc/hosts.deniedssh

All necessary left is to, Launch the denyhosts service python init script and restart the syslogd. Next after denyhosts will start blocking up incorrect SSH logins

So let’s restart syslog and start denyhosts

# /etc/rc.d/syslogd restart
# /usr/local/etc/rc.d/denyhosts start

Now script kiddies would have some hard time breaking in to your server guessing your user password with a large words dictinary, if they try to break they will be soon filtered by the hosts.deny rules added by denyhosts.

It’s important to say as you can also see from the denyhosts.conf file that denyhosts readds new ips to the file with ips to include in hosts.deny every 30 seconds.