crazy hackers and logwatch

[Jason L Tibbitts III]

>>>>> "NBC" == Neil B Cohen <nbc at cisco.com> writes:

NBC> Hi - What exactly is denyhosts?

> yum info denyhosts
Setting up Repos
Reading repository metadata in from local files
base      : ################################################## 1667/1667
updates   : ################################################## 966/966
local     : ################################################## 70/70
extras    : ################################################## 1177/1177
Available Packages
Name   : denyhosts
Arch   : noarch
Version: 0.6.0
Release: 1.fc3
Size   : 19 k
Repo   : extras
Summary: A script to help thwart ssh server attacks
Description:
 DenyHosts is a Python script that analyzes the sshd server log
messages to determine which hosts are attempting to hack into your
system. It also determines what user accounts are being targeted. It
keeps track of the frequency of attempts from each host and, upon
discovering a repeated attack host, updates the /etc/hosts.deny file
to prevent future break-in attempts from that host.  Email reports can
be sent to a system admin.


There's also the web site at denyhosts.sf.net.

NBC> I'm running FC3 on my firewall machine at home. Can I do a 'yum
NBC> install denyhosts'?

Yes, if you have the extras repo enabled.

NBC> Is there documentation on how to configure it?

Not much to it; you just do

chkconfig denyhosts on; service denyhosts start

adjust the run frequency in /etc/cron.d/denyhosts and look over the
well-commented /etc/denyhosts.conf

 - J<