linux logic: How to Install DenyHosts In Centos-6

How to Install DenyHosts In Centos-6

wget -c http://downloads.sourceforge.net/project/denyhosts/denyhosts/2.6/DenyHosts-2.6.tar.gz?r=http%3A%2%2Fsourceforge.net%2Fprojects%2Fdenyhosts%2Ffiles%2Fdenyhosts%2F2.6%2F&ts=1320260346&use_mirror=sunet

tar -xzf DenyHosts-2.6.tar.gz
cd DenyHosts-2.6
python setup.py install
cp daemon-control-dist /etc/init.d/denyhosts
cp denyhosts.cfg-dist denyhosts.cfg
mkdir /usr/share/denyhosts/data
chkconfig --add denyhosts
cp -rp denyhosts.cfg /usr/share/denyhosts/denyhosts.cfg
vi /usr/share/denyhosts/denyhosts.cfg
/etc/rc.d/init.d/denyhosts start
/etc/rc.d/init.d/denyhosts status

Configuring DenyHosts
Now that Denyhosts is up and running, we'll configure and fine-tune it. Open the settings file to proceed.

vim /usr/share/denyhosts/denyhosts.cfg

Once the file is opened, look up the following line:

#PLUGIN_DENY=/usr/bin/true

Once found, replace it with this line:

PLUGIN_DENY=/root/notify_isp.rb

This will point to a file that has not yet been made, but will bemade in your home folder. So replace /root with your home directory and your username. The file will be created lter in this tutorial.

Now look up the next lines and uncomment them:

#SYNC_SERVER = http://xmlrpc.denyhosts.net:9911
#SYNC_INTERVAL = 1h
#SYNC_UPLOAD = yes
#SYNC_DOWNLOAD = yes
#SYNC_DOWNLOAD_THRESHOLD = 3
Installing prerequisites
Now we're going to install ruby as the script that we'll becreating later is written in Ruby.

sudo apt-get install ruby -y

We'll also need whois for the script to look up IP-addresses to match e-mail addresses from their ISP.

sudo apt-get install whois -y

Creating the script
Now we're going to creat the script. I recoomend doing that in your home directory.

touch ~/notify_isp.rb

Now open the script to fill it with the following script:

[code]#! /usr/bin/ruby

#Ruby DenyHosts plugin to report attacker to ISP
#


#######################################################################################
####### PLEASE READ INSTRUCTIONS: http://github.com/nazar/report-hack-isp/wikis #######
#######################################################################################

require 'net/smtp'

#SMTP server
SMTP_SERVER = 'localhost'
SMTP_PORT = 25

#EMAIL message setup
EMAIL_FROM = 'ADD_YOUR_RETURN_EMAIL_HERE' ####### ADD YOUR ACTUALL EMAIL ADDRESS HERE ##########
EMAIL_SUBJECT = 'Security Alert - Your Server May Have Been Hacked!'
# Leave empty to not send a mail to a CC address
CC = ''
# Same as for the CC address, you probably only need one of these
BCC = ''

#LOG_FILE = SSHD's log file ###### UPDATE THIS TO YOUR ACTUAL SSHD LOG FILE LOCATION #####
LOG_FILE = '/var/log/auth.log'

#misc
TIME_LOCALE = 'GMT+1'
EMAIL_LOG_FILE = '/var/log/notify_isp.log' ##### CHECK PERMISSIONS ON DESTINATION DIRECTORY.

#guess apps... override if required
GREP_BIN = `which grep`.strip
CAT_BIN = `which cat`.strip
WHOIS_BIN = `which whois`.strip
HOST_BIN = `which host`.strip
TOUCH_BIN = `which touch`.strip

#check that we have all our BINs
raise 'Could not find grep on your system. Manually configure GREP_BIN' if GREP_BIN == ''
raise 'Could not find cat on your system. Manually configure CAT_BIN' if CAT_BIN == ''
raise 'Could not find whois on your system. Manually configure WHOIS_BIN' if WHOIS_BIN == ''
raise 'Could not find host on your system. Manually configure HOST_BIN' if HOST_BIN == ''
raise 'Could not find touch on your system. Manually configure TOUCH_BIN' if HOST_BIN == ''


################# UTILS ########################
def time2str( tm )
  # [ruby-list:7928]
  gmt = Time.at(tm.to_i)
  gmt.gmtime
  offset = tm.to_i - Time.local(*gmt.to_a[0,6].reverse).to_i

  sprintf '%s, %s %s %d %02d:%02d:%02d %+.2d%.2d',
          tm.strftime('%a'), tm.mday, tm.strftime('%B'),
          tm.year, tm.hour, tm.min, tm.sec,
          *(offset / 60).divmod(60)
end

def get_email_message(to_address, offender, evidence)
  to_cc = CC.length > 0 ? "\nCC: #{CC}" : ''
  to_bcc = BCC.length > 0 ? "\nBCC: #{BCC}" : ''

  email_message = <<< email unless email == nil
  end
  #if contacts includes an abuse@ address then only send it to those.
  tmp = result.select { |email| email[/abuse@/] }
  result = tmp if tmp.length > 0
  result.uniq! if result.length > 1
  return result.uniq
end


################# MAIN ##########################

#extract ip/domain from passed parameter
if ARGV.length > 0
  host = ARGV[0]
else
  raise 'No ip address or host given. Exiting'
end

#make sure the EMAIL_LOG_FILE exists
eval("`#{TOUCH_BIN} #{EMAIL_LOG_FILE}`")

#extract all email contacts for given host
contacts = get_contacts_for_host(host)

#lookup top level domain name and extract domain contact info
#if given ip then lookup to hostname
if host[/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/]
  host_domain = eval("`#{HOST_BIN} #{host}`").strip
  unless host_domain =~ /not found:/
    host_domain = host_domain[/.+\.(\w+\.\w+)/,1]
  else #no good... no revers DNS pointer
    host_domain = nil
  end
else
  host_domain = host[/.+\.(\w+\.\w+)/,1]
end

if host_domain
  domain_contacts = get_contacts_for_host(host_domain)
  contacts << domain_contacts if domain_contacts.length > 0
end

#filter out duplicates one last time
contacts.uniq! if contacts.length > 1

raise "No email addresses were returned" unless contacts.length > 0

#extract evidence from ssh log file using the reported host as a filter
evidence = eval("`#{CAT_BIN} #{LOG_FILE} | #{GREP_BIN} #{host}`").strip
raise "No evidence found for #{host}. Aborting" unless evidence && (evidence.length > 0)

#workaround for DenyHosts that runs the plugin evrytime an IP is added against all blacklisted IPS
sent = eval("`#{CAT_BIN} #{EMAIL_LOG_FILE} | #{GREP_BIN} #{host}`").strip
raise "Host #{host} has already been reported. Not reporting again." if sent && sent.length > 0

#are we CC/BCCing ourselves?
contacts << CC if CC.length > 0
contacts << BCC if BCC.length > 0

#by the time we get here we have evidence against a newly reported host
Net::SMTP.start(SMTP_SERVER, SMTP_PORT) do |smtp|
  
  begin
    #send email to each returned address
    contacts.flatten.each do |email|
      smtp.send_message get_email_message(email, host, evidence), EMAIL_FROM, email
      #log ip address and email
      my_file = File.new(EMAIL_LOG_FILE, 'a+')
      my_file.puts "Report generated for #{host} on #{Time.now.to_s} and sent to #{email}"
    end
  ensure
    smtp.finish
  end

end

[/code]

Make sure to assign the script the right permissions to make it executable.

chmod a+x notify_isp.rb

Now make sure you corrected the following lines with values that apply to you.

SMTP_SERVER = 'localhost'
SMTP_PORT = 25
EMAIL_FROM = 'ADD_YOUR_RETURN_EMAIL_HERE' ####### ADD YOUR ACTUALL EMAIL ADDRESS HERE ##########
LOG_FILE = '/var/log/auth.log'
TIME_LOCALE = 'GMT+1'
EMAIL_LOG_FILE = '/var/log/notify_isp.log' ##### CHECK PERMISSIONS ON DESTINATION DIRECTORY.

Note that the LOG_FILE will probably be right here, but you might want to double check it. Also the EMAIL_LOG_FILE doesn't exist yet, so we're going to make sure it exists with the proper permissions.

Creating the email log file
Now that we created the script, we'll need to create the log file you can look up later to check if e-mails are indeed sent to the ISP's. First, we're going to create the empty file:

sudo touch /var/log/notify_isp.log

Now make sure it's assigned the right permissions.

sudo chown root:root /var/log/notify_isp.log; sudo chmod 775 /var/log/notify_isp.log
Restart Denyhosts
Now we need to restart DenyHosts in order to use the script and the other configurations.

sudo service denyhosts restart

linux logic

Sunday, June 10, 2012

How to Install DenyHosts In Centos-6

No comments:

Post a Comment

About Me