Local host always being added to /etc/hosts.deny when trying to SSH

Question

I have a rather odd problem with my server. For some reason the local hostname for my workstation keeps getting added to the /etc/hosts.deny and when I try to SSH I get:

ssh_exchange_identification: Connection closed by remote host

If I use another workstation and delete my hostname from the file, I have a about a 10 second window to login from my workstation before its added again. My workstation is running Mac OSX Mountain Lion and I'm using ssh from the Terminal. Any idea what could be up or how to find out what's up?

You should be able to fix this by adding your hostname to`/etc/hosts.allow`. Are you running any program to modify the hosts.allow/deny files (like denyhosts) ? — Manula Waidyanatha, Mar 20 '13 at 03:14
Is the affected machine running OSX (question body) or Linux (tags)? It's probably denyhosts running amok anyway, but please clarify. — Gilles 'SO- stop being evil', Mar 20 '13 at 22:53

score 0 · Answer 1 · answered Sep 14 '13 at 16:20

0

I agree with Gilles - this sounds very much like there's a tool running on your computer that monitors the ssh log for failed login attempts, like DenyHosts or Fail2ban. SSH itself won't modify the /etc/hosts.deny file.

answered Sep 14 '13 at 16:20

Martin von Wittich

13,857
6
51
74

Local host always being added to /etc/hosts.deny when trying to SSH

1 Answers1