Any point using Denyhosts for SSH when only RSA key logins are allowed anyway?

Question

Right, so if I can only SSH into my box by having the appropriate RSA keys configured, is there any point in using Denyhosts for SSH as well? Or is Denyhosts only looking at keyboard-interactive / password logins for SSH?

Don't get me wrong, Denyhosts is the absolute mac-daddy, but I've recently switched off keyboard-interactive logins altogether and wondered if it was worth still keeping Denyhosts running.

(If you don't know Denyhosts, it basically maintains - and uses - an IP blacklist of people who keep trying to get into SSH but with the wrong username / password etc.)

score 4 · Accepted Answer · answered Aug 07 '11 at 12:16

4

By my read of it, there are two reasons to continue using DenyHosts:

Failed-login processing still takes resources, so using it keeps that lower.
Your log-files with DenyHosts will be a lot smaller than your log-files without it.

If either of those don't really matter to you, then DenyHosts isn't doing anything for you.

answered Aug 07 '11 at 12:16

sysadmin1138

133,124
18
176
300

So, basically, when a keyboard login is attempted and the user is presented with "access denied" (or whatever), Denyhosts is still going to count it as a login attempt? Hmmm, that could work... – Dougal Aug 07 '11 at 16:45

score 0 · Answer 2 · answered Aug 07 '11 at 11:44

0

It minimizes the "bad actor/person" from slamming additional resources.

answered Aug 07 '11 at 11:44

user48838

7,431
2
18
14

Don't understand this answer :( – Dougal Aug 07 '11 at 12:36
1

@Dougal, It is the same thing as what sysadmin1138 said, but not as clear. :) – snap Aug 07 '11 at 15:27
It spare the ssh daemon/process from having to deal with/process any additional attacks from the listed IP address. – user48838 Aug 07 '11 at 19:17
aaah, ok, cool. – Dougal Aug 08 '11 at 14:23

score 0 · Answer 3 · answered Aug 07 '11 at 13:09

Depends on the other services running on that box. If it's a webserver with an online store, you might be losing business because of an incorrectly denied host - though this seems unlikely, especially if you're only using your own denyhost data.

On the other hand, if you're running other services that might be less secure than your locked down ssh server - it may be worth keeping the deny to protect your other services if the attacker tires of your ssh, or indeed if you ARE using shared data.

Long and the short, if you have no worry about false positives (eg. the people who might fail to access the server have another way to contact you, and it won't harm any relationship with them!) then there's no reason not to keep denying hosts. Also its fun ;)

a) The default denyhosts.conf only creates entries for sshd. b) How many other applicable daemons even read /etc/hosts.deny (or equivalent)? — andol, Aug 07 '11 at 13:28

score 0 · Answer 4 · answered Feb 10 '15 at 02:35

To add to the other answers, there is one word of caution I have encountered (in the form of a notice on the ArchWiki) when reading about tools like denyhosts (e.g. Fail2ban):

Warning: Using an IP blacklist will stop trivial attacks but it relies on an additional daemon and successful logging (the partition containing /var can become full, especially if an attacker is pounding on the server). Additionally, if the attacker knows your IP address, they can send packets with a spoofed source header and get you locked out of the server. ...

So especially if you're only allowing public-key authentication it may be worth considering just using a non-standard port (to avoid blind attacks on port 22) and intentionally not using denyhosts.

Any point using Denyhosts for SSH when only RSA key logins are allowed anyway?

4 Answers4