OCE系统安装DenyHosts程序防止黑客暴力破解root账号密码

OCE所用的centos系统缺省即支持python2.3，使得我们可以使用暴力破解克星：DenyHosts

下载地址：***.***/projects/denyhosts/files/denyhosts/2.5/DenyHosts-2.5-python2.3.noarch.rpm/download

安装：
[root@localhost opt]# rpm -ivh DenyHosts-2.5-python2.3.noarch.rpm
Preparing...                ########################################### [100%]
   1:DenyHosts              ########################################### [100%]

创建配置文件：
[root@localhost /]# cd /usr/share/denyhosts/
[root@localhost denyhosts]# ls
CHANGELOG.txt        denyhosts.cfg-dist  plugins     scripts
daemon-control-dist  LICENSE.txt         README.txt  setup.py
[root@localhost denyhosts]# cp denyhosts.cfg-dist denyhosts.cfg

缺省denyhosts.cfg文件的规则是：
1.同一个IP使用不存在的账号连续登录输入错误密码5次，即被封IP
2.同一个IP使用存在的非root账号连续登录输入错误密码10次，即被封IP
3.同一个IP使用root账号只要登录输入错误密码1次，即被封IP

修改配置文件：
[root@localhost denyhosts]# vi denyhosts.cfg
将25行用#号注释掉 #SECURE_LOG=/private/var/log/system.log
让root账号有2次输错密码的机会，修改129行 DENY_THRESHOLD_ROOT = 3

将denyhost启动脚本添加到服务中去：
[root@localhost denyhosts]# cp daemon-control-dist /etc/init.d/daemon-control

启动脚本：
[root@localhost /]# service daemon-control start
starting DenyHosts:    /usr/bin/env python /usr/bin/denyhosts.py --daemon --cOnfig=/usr/share/denyhosts/denyhosts.cfg

查看状态：
[root@localhost /]# service daemon-control status
DenyHosts is running with pid = 14199
[root@localhost /]# ps -ef|grep 14199
root     14199     1  0 15:47 ?        00:00:00 python /usr/bin/denyhosts.py --daemon --cOnfig=/usr/share/denyhosts/denyhosts.cfg
root     14211 14074  0 15:48 pts/3    00:00:00 grep 14199

可以使用的命令有
service daemon-control start/stop/status/restart/debug
更多帮助请参考文档
***.***/faq.html#3_16

实时检查一下/etc/hosts.deny，可能需要10分钟左右就会出现黑客的IP，这些IP将无法使用ssh连接OCE服务器：
[root@localhost denyhosts]# tail -f /etc/hosts.deny
sshd: 125.131.226.196
sshd: 222.242.186.83
sshd: 59.103.0.133
sshd: 61.132.221.220
sshd: 221.236.13.28
sshd: 88.191.31.99
sshd: 125.46.54.252
sshd: 202.106.171.102
sshd: 69.197.163.178
sshd: 203.116.18.173

下面是尝试攻击某OCE系统的所有IP地址：
[root@localhost ~]# cat /etc/hosts.deny
#
# hosts.deny    This file contains access rules which are used to
#               deny connections to network services that either use
#               the tcp_wrappers library or that have been
#               started through a tcp_wrappers-enabled xinetd.
#
#               The rules in this file can also be set up in
#               /etc/hosts.allow with a 'deny' option instead.
#
#               See 'man 5 hosts_access' and 'man 5 hosts_options'
#               for information on rule syntax.
#               See 'man tcpd' for information on tcp_wrappers.
#
# The portmap line is redundant, but it is left to remind you that
# the new secure portmap uses hosts.deny and hosts.allow.  In particular
# you should know that NFS uses portmap!
sshd: 121.9.212.73
sshd: 121.15.207.100
sshd: 202.109.242.18
sshd: 219.143.125.149
sshd: 210.176.183.154
sshd: 211.141.110.200
sshd: 125.88.130.12
sshd: 203.113.91.188
sshd: 122.225.30.22
sshd: 218.97.129.220
sshd: 222.73.177.179
sshd: 125.131.226.196
sshd: 222.242.186.83
sshd: 59.103.0.133
sshd: 61.132.221.220
sshd: 221.236.13.28
sshd: 88.191.31.99
sshd: 125.46.54.252
sshd: 202.106.171.102
sshd: 69.197.163.178
sshd: 203.116.18.173