[Ubuntu 12.04 server] denyhosts wil niet purgen

[noakes]

Ik heb net denyhosts geinstalleerd. Aangezien ik wat wil testen heb ik de purge periode (waarna de hosts die denied worden, worden gepurged) op 1 minuut gezet.

code:

########################################################################
#
# PURGE_DENY: removed HOSTS_DENY entries that are older than this time
#             when DenyHosts is invoked with the --purge flag
#
#      format is: i[dhwmy]
#      Where 'i' is an integer (eg. 7)
#            'm' = minutes
#            'h' = hours
#            'd' = days
#            'w' = weeks
#            'y' = years
#
# never purge:
#PURGE_DENY =
# purge entries older than 1 minute
PURGE_DENY = 1m
#
# purge entries older than 1 week
#PURGE_DENY = 1w
#
# purge entries older than 5 days
#PURGE_DENY = 5d
#######################################################################

Via:

code:

sudo service denyhosts stop
sudo denyhosts --purge

zouden dan de entries in /etc/hosts.deny moeten worden gepurged. Dit gebeurt echter niet.

Dit vond ik in /var/log/denyhosts

code:

2012-07-15 11:31:59,552 - denyhosts   : INFO     DenyHosts launched with the following args:
2012-07-15 11:31:59,552 - denyhosts   : INFO        /usr/sbin/denyhosts --daemon --purge --config=/etc/denyhosts.conf
2012-07-15 11:31:59,552 - prefs       : INFO     DenyHosts configuration settings:
2012-07-15 11:31:59,552 - prefs       : INFO        ADMIN_EMAIL: [root@localhost]
2012-07-15 11:31:59,552 - prefs       : INFO        AGE_RESET_INVALID: [864000]
2012-07-15 11:31:59,552 - prefs       : INFO        AGE_RESET_RESTRICTED: [2160000]
2012-07-15 11:31:59,552 - prefs       : INFO        AGE_RESET_ROOT: [2160000]
2012-07-15 11:31:59,552 - prefs       : INFO        AGE_RESET_VALID: [432000]
2012-07-15 11:31:59,552 - prefs       : INFO        ALLOWED_HOSTS_HOSTNAME_LOOKUP: [no]
2012-07-15 11:31:59,553 - prefs       : INFO        BLOCK_SERVICE: [sshd]
2012-07-15 11:31:59,553 - prefs       : INFO        DAEMON_LOG: [/var/log/denyhosts]
2012-07-15 11:31:59,553 - prefs       : INFO        DAEMON_LOG_MESSAGE_FORMAT: [%(asctime)s - %(name)-12s: %(levelname)-8s %(message)s]
2012-07-15 11:31:59,553 - prefs       : INFO        DAEMON_LOG_TIME_FORMAT: [None]
2012-07-15 11:31:59,553 - prefs       : INFO        DAEMON_PURGE: [3600]
2012-07-15 11:31:59,553 - prefs       : INFO        DAEMON_SLEEP: [30]
2012-07-15 11:31:59,553 - prefs       : INFO        DENY_THRESHOLD_INVALID: [5]
2012-07-15 11:31:59,553 - prefs       : INFO        DENY_THRESHOLD_RESTRICTED: [1]
2012-07-15 11:31:59,553 - prefs       : INFO        DENY_THRESHOLD_ROOT: [1]
2012-07-15 11:31:59,553 - prefs       : INFO        DENY_THRESHOLD_VALID: [10]
2012-07-15 11:31:59,553 - prefs       : INFO        FAILED_ENTRY_REGEX: [None]
2012-07-15 11:31:59,553 - prefs       : INFO        FAILED_ENTRY_REGEX2: [None]
2012-07-15 11:31:59,553 - prefs       : INFO        FAILED_ENTRY_REGEX3: [None]
2012-07-15 11:31:59,554 - prefs       : INFO        FAILED_ENTRY_REGEX4: [None]
2012-07-15 11:31:59,554 - prefs       : INFO        FAILED_ENTRY_REGEX5: [None]
2012-07-15 11:31:59,554 - prefs       : INFO        FAILED_ENTRY_REGEX6: [None]
2012-07-15 11:31:59,554 - prefs       : INFO        FAILED_ENTRY_REGEX7: [None]
2012-07-15 11:31:59,554 - prefs       : INFO        HOSTNAME_LOOKUP: [YES]
2012-07-15 11:31:59,554 - prefs       : INFO        HOSTS_DENY: [/etc/hosts.deny]
2012-07-15 11:31:59,554 - prefs       : INFO        LOCK_FILE: [/run/denyhosts.pid]
2012-07-15 11:31:59,554 - prefs       : INFO        PLUGIN_DENY: [None]
2012-07-15 11:31:59,554 - prefs       : INFO        PLUGIN_PURGE: [None]
2012-07-15 11:31:59,554 - prefs       : INFO        PURGE_DENY: [60]
2012-07-15 11:31:59,554 - prefs       : INFO        PURGE_THRESHOLD: [0]
2012-07-15 11:31:59,554 - prefs       : INFO        RESET_ON_SUCCESS: [no]
2012-07-15 11:31:59,555 - prefs       : INFO        SECURE_LOG: [/var/log/auth.log]
2012-07-15 11:31:59,555 - prefs       : INFO        SMTP_DATE_FORMAT: [%a, %d %b %Y %H:%M:%S %z]
2012-07-15 11:31:59,555 - prefs       : INFO        SMTP_FROM: [DenyHosts <nobody@localhost>]
2012-07-15 11:31:59,555 - prefs       : INFO        SMTP_HOST: [localhost]
2012-07-15 11:31:59,555 - prefs       : INFO        SMTP_PASSWORD: [None]
2012-07-15 11:31:59,555 - prefs       : INFO        SMTP_PORT: [25]
2012-07-15 11:31:59,555 - prefs       : INFO        SMTP_SUBJECT: [DenyHosts Report]
2012-07-15 11:31:59,555 - prefs       : INFO        SMTP_USERNAME: [None]
2012-07-15 11:31:59,555 - prefs       : INFO        SSHD_FORMAT_REGEX: [None]
2012-07-15 11:31:59,555 - prefs       : INFO        SUCCESSFUL_ENTRY_REGEX: [None]
2012-07-15 11:31:59,555 - prefs       : INFO        SUSPICIOUS_LOGIN_REPORT_ALLOWED_HOSTS: [YES]
2012-07-15 11:31:59,555 - prefs       : INFO        SYNC_DOWNLOAD: [yes]
2012-07-15 11:31:59,556 - prefs       : INFO        SYNC_DOWNLOAD_RESILIENCY: [18000]
2012-07-15 11:31:59,556 - prefs       : INFO        SYNC_DOWNLOAD_THRESHOLD: [3]
2012-07-15 11:31:59,556 - prefs       : INFO        SYNC_INTERVAL: [3600]
2012-07-15 11:31:59,556 - prefs       : INFO        SYNC_SERVER: [None]
2012-07-15 11:31:59,556 - prefs       : INFO        SYNC_UPLOAD: [yes]
2012-07-15 11:31:59,556 - prefs       : INFO        SYSLOG_REPORT: [no]
2012-07-15 11:31:59,556 - prefs       : INFO        WORK_DIR: [/var/lib/denyhosts]
2012-07-15 11:31:59,556 - denyhosts   : INFO     restricted: set([])
2012-07-15 11:31:59,557 - denyhosts   : INFO     launching DenyHosts daemon (version 2.6)...
2012-07-15 11:31:59,559 - denyhosts   : INFO     DenyHosts daemon is now running, pid: 21711
2012-07-15 11:31:59,560 - denyhosts   : INFO     send daemon process a TERM signal to terminate cleanly
2012-07-15 11:31:59,560 - denyhosts   : INFO       eg.  kill -TERM 21711
2012-07-15 11:31:59,560 - denyhosts   : INFO     monitoring log: /var/log/auth.log
2012-07-15 11:31:59,560 - denyhosts   : INFO     sync_time: 3600
2012-07-15 11:31:59,560 - denyhosts   : INFO     daemon_purge:      3600
2012-07-15 11:31:59,560 - denyhosts   : INFO     daemon_sleep:      30
2012-07-15 11:35:53,082 - denyhosts   : INFO     DenyHosts daemon is shutting down

Ik zie echter niks vreemds, dus kan er niet goed de vinger achter krijgen waarom 't niet werkt.
Iemand enig idee waarom de entries niet gepurged worden?

PS /etc/hosts.deny is gewoon netjes aanwezig. Ook heb ik door meermaals verkeerd inloggen via ssh gezien dat mijn ip netjes wordt toegevoegd aan dit bestand.

[Hero of Time]

Als je de twee commando's nou eens omdraait? Het is heel goed mogelijk dat je command line naar de daemon probeert te connecten om 't uit te voeren. Andere optie is dat je geen bestand meegeeft om in te kijken wat je purge opties zijn. Draai eens met --verbose.

Heeft Google geen antwoord op je vraag?

[noakes]

Hero Of Time schreef op zondag 15 juli 2012 @ 15:52:
Als je de twee commando's nou eens omdraait? Het is heel goed mogelijk dat je command line naar de daemon probeert te connecten om 't uit te voeren.

Ik heb de volgorde uit meerdere howto's gehaald. De volgorde is correct.
Als ik het in omgekeerde volgorde doe, krijg ik een error omdat denyhosts al actief is (denyhosts.pid aanwezig)

Hero Of Time schreef op zondag 15 juli 2012 @ 15:52:
Andere optie is dat je geen bestand meegeeft om in te kijken wat je purge opties zijn. Draai eens met --verbose.

Dit geeft:

code:

purging entries older than: Sun Jul 15 17:02:16 2012
num entries purged: 0
restricted: set([])
Processing log file (/var/log/auth.log) from offset (12966)

Hero Of Time schreef op zondag 15 juli 2012 @ 15:52:
Heeft Google geen antwoord op je vraag?

Nee, helaas nog niks gevonden.
Correctie:

Entries in HOSTS_DENY that were added before the PURGE_DENY value was defined (for example, if you upgraded from a previous version of DenyHosts or you have just decided to enable the purge functionality) will not be impacted by the --purge flag. However, if you wish for these "legacy" HOSTS_DENY entries to be subject to expiration then you will need to migrate your HOSTS_DENY data.

Once PURGE_DENY has been configured to a non-empty value, DenyHosts will automatically timestamp each record that is added to HOSTS_DENY. If PURGE_DENY is empty then DenyHosts will not timestamp the records added to HOSTS_DENY.

Dit zou het wel eens kijken zijn (bron)

[ Voor 23% gewijzigd door noakes op 15-07-2012 17:13 ]