How to Install DenyHosts In Centos-6

How to Install DenyHosts In Centos-6

 wget -c http://downloads.sourceforge.net/project/denyhosts/denyhosts/2.6/DenyHosts-2.6.tar.gz?r=http%3A%2%2Fsourceforge.net%2Fprojects%2Fdenyhosts%2Ffiles%2Fdenyhosts%2F2.6%2F&ts=1320260346&use_mirror=sunet

tar -xzf DenyHosts-2.6.tar.gz
cd DenyHosts-2.6
python setup.py install
cp daemon-control-dist /etc/init.d/denyhosts
cp denyhosts.cfg-dist denyhosts.cfg
mkdir /usr/share/denyhosts/data
chkconfig --add denyhosts
cp -rp denyhosts.cfg /usr/share/denyhosts/denyhosts.cfg
vi  /usr/share/denyhosts/denyhosts.cfg
 /etc/rc.d/init.d/denyhosts start
 /etc/rc.d/init.d/denyhosts status

1. Configuring DenyHosts
   Now that Denyhosts is up and running, we'll configure and fine-tune it. Open the settings file to proceed.
   
   
    vim /usr/share/denyhosts/denyhosts.cfg
   
   Once the file is opened, look up the following line:
   
   
   
   #PLUGIN_DENY=/usr/bin/true
   
   Once found, replace it with this line:
   
   
   
   PLUGIN_DENY=/root/notify_isp.rb
   
   This will point to a file that has not yet been made, but will bemade in your home folder. So replace /root with your home directory and your username. The file will be created lter in this tutorial.
   
   Now look up the next lines and uncomment them:
   
   
   
   #SYNC_SERVER = http://xmlrpc.denyhosts.net:9911
   #SYNC_INTERVAL = 1h
   #SYNC_UPLOAD = yes
   #SYNC_DOWNLOAD = yes
   #SYNC_DOWNLOAD_THRESHOLD = 3
   
   
2. Installing prerequisites
   Now we're going to install ruby as the script that we'll becreating later is written in Ruby.
   
   
   sudo apt-get install ruby -y
   
   We'll also need whois for the script to look up IP-addresses to match e-mail addresses from their ISP.
   
   
   
   sudo apt-get install whois -y
   
   
3. Creating the script
   Now we're going to creat the script. I recoomend doing that in your home directory.
   
   
   touch ~/notify_isp.rb
   
   Now open the script to fill it with the following script:
   
   
   

   [code]#! /usr/bin/ruby
   
   #Ruby DenyHosts plugin to report attacker to ISP
   #
   
   
   #######################################################################################
   ####### PLEASE READ INSTRUCTIONS: http://github.com/nazar/report-hack-isp/wikis #######
   #######################################################################################
   
   require 'net/smtp'
   
   #SMTP server
   SMTP_SERVER = 'localhost'
   SMTP_PORT = 25
   
   #EMAIL message setup
   EMAIL_FROM = 'ADD_YOUR_RETURN_EMAIL_HERE' ####### ADD YOUR ACTUALL EMAIL ADDRESS HERE ##########
   EMAIL_SUBJECT = 'Security Alert - Your Server May Have Been Hacked!'
   # Leave empty to not send a mail to a CC address
   CC = ''
   # Same as for the CC address, you probably only need one of these
   BCC = ''
   
   #LOG_FILE = SSHD's log file ###### UPDATE THIS TO YOUR ACTUAL SSHD LOG FILE LOCATION #####
   LOG_FILE = '/var/log/auth.log'
   
   #misc
   TIME_LOCALE = 'GMT+1'
   EMAIL_LOG_FILE = '/var/log/notify_isp.log' ##### CHECK PERMISSIONS ON DESTINATION DIRECTORY.
   
   #guess apps... override if required
   GREP_BIN = `which grep`.strip
   CAT_BIN = `which cat`.strip
   WHOIS_BIN = `which whois`.strip
   HOST_BIN = `which host`.strip
   TOUCH_BIN = `which touch`.strip
   
   #check that we have all our BINs
   raise 'Could not find grep on your system. Manually configure GREP_BIN' if GREP_BIN == ''
   raise 'Could not find cat on your system. Manually configure CAT_BIN' if CAT_BIN == ''
   raise 'Could not find whois on your system. Manually configure WHOIS_BIN' if WHOIS_BIN == ''
   raise 'Could not find host on your system. Manually configure HOST_BIN' if HOST_BIN == ''
   raise 'Could not find touch on your system. Manually configure TOUCH_BIN' if HOST_BIN == ''
   
   
   ################# UTILS ########################
   def time2str( tm )
     # [ruby-list:7928]
     gmt = Time.at(tm.to_i)
     gmt.gmtime
     offset = tm.to_i - Time.local(*gmt.to_a[0,6].reverse).to_i
   
     sprintf '%s, %s %s %d %02d:%02d:%02d %+.2d%.2d',
             tm.strftime('%a'), tm.mday, tm.strftime('%B'),
             tm.year, tm.hour, tm.min, tm.sec,
             *(offset / 60).divmod(60)
   end
   
   def get_email_message(to_address, offender, evidence)
     to_cc = CC.length > 0 ? "\nCC: #{CC}" : ''
     to_bcc = BCC.length > 0 ? "\nBCC: #{BCC}" : ''
   
     email_message = <<< email unless email == nil
     end
     #if contacts includes an abuse@ address then only send it to those.
     tmp = result.select { |email| email[/abuse@/] }
     result = tmp if tmp.length > 0
     result.uniq! if result.length > 1
     return result.uniq
   end
   
   
   ################# MAIN ##########################
   
   #extract ip/domain from passed parameter
   if ARGV.length > 0
     host = ARGV[0]
   else
     raise 'No ip address or host given. Exiting'
   end
   
   #make sure the EMAIL_LOG_FILE exists
   eval("`#{TOUCH_BIN} #{EMAIL_LOG_FILE}`")
   
   #extract all email contacts for given host
   contacts = get_contacts_for_host(host)
   
   #lookup top level domain name and extract domain contact info
   #if given ip then lookup to hostname
   if host[/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/]
     host_domain = eval("`#{HOST_BIN} #{host}`").strip
     unless host_domain =~ /not found:/
       host_domain = host_domain[/.+\.(\w+\.\w+)/,1]
     else #no good... no revers DNS pointer
       host_domain = nil
     end
   else
     host_domain = host[/.+\.(\w+\.\w+)/,1]
   end
   
   if host_domain
     domain_contacts = get_contacts_for_host(host_domain)
     contacts << domain_contacts if domain_contacts.length > 0
   end
   
   #filter out duplicates one last time
   contacts.uniq! if contacts.length > 1
   
   raise "No email addresses were returned" unless contacts.length > 0
   
   #extract evidence from ssh log file using the reported host as a filter
   evidence = eval("`#{CAT_BIN} #{LOG_FILE} | #{GREP_BIN} #{host}`").strip
   raise "No evidence found for #{host}. Aborting" unless evidence && (evidence.length > 0)
   
   #workaround for DenyHosts that runs the plugin evrytime an IP is added against all blacklisted IPS
   sent = eval("`#{CAT_BIN} #{EMAIL_LOG_FILE} | #{GREP_BIN} #{host}`").strip
   raise "Host #{host} has already been reported. Not reporting again." if sent && sent.length > 0
   
   #are we CC/BCCing ourselves?
   contacts << CC if CC.length > 0
   contacts << BCC if BCC.length > 0
   
   #by the time we get here we have evidence against a newly reported host
   Net::SMTP.start(SMTP_SERVER, SMTP_PORT) do |smtp|
     
     begin
       #send email to each returned address
       contacts.flatten.each do |email|
         smtp.send_message get_email_message(email, host, evidence), EMAIL_FROM, email
         #log ip address and email
         my_file = File.new(EMAIL_LOG_FILE, 'a+')
         my_file.puts "Report generated for #{host} on #{Time.now.to_s} and sent to #{email}"
       end
     ensure
       smtp.finish
     end
   
   end
   
   [/code]

   
   Make sure to assign the script the right permissions to make it executable.
   
   chmod a+x notify_isp.rb
   Now make sure you corrected the following lines with values that apply to you.
   
   SMTP_SERVER = 'localhost'
   SMTP_PORT = 25
   EMAIL_FROM = 'ADD_YOUR_RETURN_EMAIL_HERE' ####### ADD YOUR ACTUALL EMAIL ADDRESS HERE ##########
   LOG_FILE = '/var/log/auth.log'
   TIME_LOCALE = 'GMT+1'
   EMAIL_LOG_FILE = '/var/log/notify_isp.log' ##### CHECK PERMISSIONS ON DESTINATION DIRECTORY.
   
   Note that the LOG_FILE will probably be right here, but you might want to double check it. Also the EMAIL_LOG_FILE doesn't exist yet, so we're going to make sure it exists with the proper permissions.
   
   
   
4. Creating the email log file
   Now that we created the script, we'll need to create the log file you can look up later to check if e-mails are indeed sent to the ISP's. First, we're going to create the empty file:
   
   
   sudo touch /var/log/notify_isp.log
   
   
   Now make sure it's assigned the right permissions.
   
   
   
   sudo chown root:root /var/log/notify_isp.log; sudo chmod 775 /var/log/notify_isp.log
   
   
   
5. Restart Denyhosts
   Now we need to restart DenyHosts in order to use the script and the other configurations.
   
   
   sudo service denyhosts restart