【安全运维】Linux 利用hosts.deny 防止暴力破解ssh(文末送书)

[root@ceph-osd1 ~]# yum install openssl-devel pcre-devel ncpfs-devel postgresql-devel libssh-devel subversion-devel libncurses-devel -y

[root@ceph-osd1 ~]# wget https://www.thc.org/download.php?t=r&f=hydra-8.1.tar.gz

[root@ceph-osd1 ~]# tar zxvf hydra-8.1.tar.gz[root@ceph-osd1 ~]# cd hydra-8.1[root@ceph-osd1 hydra-8.1]# ./configure[root@ceph-osd1 hydra-8.1]# make && make install

[root@ceph-osd1 ~]# hydraHydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.
Syntax: hydra [[[-l LOGIN|-L FILE] [-p PASS|-P FILE]] | [-C FILE]] [-e nsr] [-o FILE] [-t TASKS] [-M FILE [-T TASKS]] [-w TIME] [-W TIME] [-f] [-s PORT] [-x MIN:MAX:CHARSET] [-SuvVd46] [service://server[:PORT][/OPT]]
Options:  -l LOGIN or -L FILE  login with LOGIN name, or load several logins from FILE　# -l 登陆用户名 或者 -L 登陆用户名列表文件
  -p PASS  or -P FILE  try password PASS, or load several passwords from FILE　# -p 登陆密码 或者 -P 密码字典文件
  -C FILE   colon separated "login:pass" format, instead of -L/-P options  # 使用用户名：密码 组合的破解文件。
  -M FILE   list of servers to attack, one entry per line, ':' to specify port  # 指定目标列表文件一行一条记录
  -t TASKS  run TASKS number of connects in parallel (per host, default: 16)  # 同时运行的线程数目，默认是16个
  -U        service module usage details  # 服务模块使用详情
  -h        more command line options (COMPLETE HELP)  # 更多命令选项
  server    the target: DNS, IP or 192.168.0.0/24 (this OR the -M option)  #支持扫描 域名、ip、以及网段
  service   the service to crack (see below for supported protocols)  # 破解扫描的协议
  OPT       some service modules support additional input (-U for module help)  # 更多扩展选项参看 -U 选项
 Supported services: asterisk cisco cisco-enable cvs ftp ftps http
展开收缩
-{head|get} http
展开收缩
-{get|post}-form http-proxy http-proxy-urlenum icq imap
展开收缩
 irc ldap2
展开收缩
 ldap3[-{cram|digest}md5]
展开收缩
 mssql mysql(v4) nntp oracle-listener oracle-sid pcanywhere pcnfs pop3
展开收缩
 postgres rdp redis rexec rlogin rsh s7-300 sip smb smtp
展开收缩
 smtp-enum snmp socks5 ssh sshkey svn teamspeak telnet
展开收缩
 vmauthd vnc xmpp
Hydra is a tool to guess/crack valid login/password pairs. Licensed under AGPLv3.0. The newest version is always available at http://www.thc.org/thc-hydraDon't use in military or secret service organizations, or for illegal purposes.
Example:  hydra -l user -P passlist.txt ftp://192.168.0.1 #示例：用user 用户，加上 passlist.txt密码字典，尝试破解 192.168.0.1 ftp服务器

[root@ceph-osd1 ssh-test]# pwd/root/ssh-test[root@ceph-osd1 ssh-test]# cat users.txt rootmysqlftpapachersyncttadmin[root@ceph-osd1 ssh-test]# cat passwd.txt 123456123admin123456789helloworld

[root@ceph-osd1 ssh-test]# hydra -L users.txt -P passwd.txt ssh://192.168.30.64Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.
Hydra (http://www.thc.org/thc-hydra) starting at 2016-05-03 19:04:33[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4[DATA] max 16 tasks per 1 server, overall 64 tasks, 35 login tries (l:7/p:5), ~0 tries per task[DATA] attacking service ssh on port 22[22][ssh] host: 192.168.30.64   login: root   password: 1234561 of 1 target successfully completed, 1 valid password foundHydra (http://www.thc.org/thc-hydra) finished at 2016-05-03 19:04:39

[root@ceph-osd1 ssh-test]# hydra -L users.txt -P passwd.txt -vV ssh://192.168.30.64 -o valid-info.txt[root@ceph-osd1 ssh-test]# cat valid-info.txt # Hydra v8.1 run at 2016-05-03 19:08:14 on 192.168.30.64 ssh (hydra -L users.txt -P passwd.txt -vV -o valid-info.txt ssh://192.168.30.64)[22][ssh] host: 192.168.30.64   login: root   password: 123456

[root@test deny]# tail -3f /var/log/secureMay  3 19:14:49 test sshd[23060]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.30.63  user=rootMay  3 19:14:49 test sshd[23060]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"May  3 19:14:51 test sshd[23060]: Failed password for root from 192.168.30.63 port 50704 ssh2

[root@test deny]# pwd/root/deny[root@test deny]# vim autoDeny.sh#!/bin/bash
LIST=""
#过滤出协议，尝试连接主机的ipLIST=$(cat /var/log/secure | grep "authentication failure" | awk '{print$14}' | sed -e 's/rhost=//g' -e 's/ /_/g' | uniq)
#Trusted HostsexcludeList=( "192.168.30.55" )
function chkExcludeList(){for j in "${excludeList[@]}"; do    if [[ "$1" == $j ]]; then        return 10    fidonereturn 11}
#检查并追加到hosts.deny文件中for i in $LIST; do    chkExcludeList "$i"        if [ $? != "10" ]; then            if [ "$(grep $i /etc/hosts.deny)" = "" ]; then                echo "ALL: $i : DENY" >> /etc/hosts.deny            fi        fidone

[root@test deny]# crontab -l*/1 * * * * /usr/bin/sh /root/deny/autoDeny.sh

[root@test deny]# tail -2f /etc/hosts.deny#        See 'man tcpd' for information on tcp_wrappers#

root@test ]# wget http://sourceforge.net/projects/denyhosts/files/denyhosts/2.6/DenyHosts-2.6.tar.gz[root@test ]# tar -zxvf DenyHosts-2.6.tar.gz[root@test DenyHosts-2.6]# cd DenyHosts-2.6[root@test DenyHosts-2.6]# python setup.py install[root@test DenyHosts-2.6]# cd /usr/share/denyhosts/

[root@test denyhosts]# lsCHANGELOG.txt  daemon-control-dist  data  denyhosts.cfg-dist  LICENSE.txt  plugins  README.txt  scripts  setup.py

root@test denyhosts]# cp /usr/share/denyhosts/daemon-control-dist /etc/init.d/denyhosts[root@test denyhosts]# chkconfig denyhosts on将命令加入到系统命令里，方便使用[root@test denyhosts]# cd /bin[root@test bin]# ln -s /usr/share/denyhosts/daemon-control-dist denyhosts[root@test bin]# cd ~测试下：[root@test ~]# denyhostsUsage: /usr/bin/denyhosts {start [args...] | stop | restart [args...] | status | debug | condrestart [args...] }
For a list of valid 'args' refer to:$ denyhosts.py --help

[root@test ~]# vim /usr/share/denyhosts/denyhosts.cfg#ssh的日志文件SECURE_LOG = /var/log/secure#把检测到的ip写到hosts.deny文件HOSTS_DENY = /etc/hosts.deny#多久清除已经禁止的ip，如1h 代表1小时；w周,d天,s秒,m分钟PURGE_DENY = 1h#服务名称BLOCK_SERVICE  = sshd
#无效用户名尝试的次数DENY_THRESHOLD_INVALID = 1#有效的用户名尝试的次数 （不包括root）DENY_THRESHOLD_VALID = 8# 允许root 用户尝试的次数DENY_THRESHOLD_ROOT = 3
DENY_THRESHOLD_RESTRICTED = 1#记录拒绝的host 到 该目录中WORK_DIR = /usr/share/denyhosts/data#开启可疑的主机报告SUSPICIOUS_LOGIN_REPORT_ALLOWED_HOSTS=YES
#开启域名解析HOSTNAME_LOOKUP=YES#软件的lock文件LOCK_FILE = /var/lock/subsys/denyhosts#下面是设置邮局报警，邮件接收拒绝的主机ADMIN_EMAIL = SMTP_HOST = localhostSMTP_PORT = 25SMTP_FROM = DenyHosts <nobody@localhost>SMTP_SUBJECT = DenyHosts Report#有效用户登录失败计数归零的时间AGE_RESET_VALID=5d#root用户登录失败计数归零的时间AGE_RESET_ROOT=25d#普通用户的失败登录计数重置为0的时间AGE_RESET_RESTRICTED=25d#无效用户登录失败计数归零的时间AGE_RESET_INVALID=10d
#denyhosts程序的日志文件DAEMON_LOG = /var/log/denyhosts DAEMON_SLEEP = 30sDAEMON_PURGE = 1h

[root@test ~]# denyhosts startstarting DenyHosts:    /usr/bin/env python /usr/bin/denyhosts.py --daemon --config=/usr/share/denyhosts/denyhosts.cfg

[root@test ~]# tail -f /var/log/denyhosts 2016-05-04 17:39:28,300 - denyhosts   : INFO     launching DenyHosts daemon (version 2.6)...2016-05-04 17:39:28,305 - denyhosts   : INFO     DenyHosts daemon is now running, pid: 37042016-05-04 17:39:28,305 - denyhosts   : INFO     send daemon process a TERM signal to terminate cleanly2016-05-04 17:39:28,305 - denyhosts   : INFO       eg.  kill -TERM 37042016-05-04 17:39:28,306 - denyhosts   : INFO     monitoring log: /var/log/secure2016-05-04 17:39:28,306 - denyhosts   : INFO     sync_time: 36002016-05-04 17:39:28,306 - denyhosts   : INFO     daemon_purge:      36002016-05-04 17:39:28,306 - denyhosts   : INFO     daemon_sleep:      302016-05-04 17:39:28,306 - denyhosts   : INFO     purge_sleep_ratio: 1202016-05-04 17:39:28,306 - denyhosts   : INFO     denyhosts synchronization disabled

[root@test ~]# denyhosts startstarting DenyHosts:    /usr/bin/env python /usr/bin/denyhosts.py --daemon --config=/usr/share/denyhosts/denyhosts.cfg[root@test ~]# denyhosts debugsent DenyHosts SIGUSR1