Package: denyhosts Version: 2.6-10 Severity: normal I observed that denyhosts repeatedly fails to block abusers on one of my systems. Basically the reason is that I use denyhosts even though PasswordAuthentication is disabled in ssh. For this reason there are no failed login entries in my auth.log. Some offenders fail to pick the right user names. Those are caught by denyhosts. Others repeatedly fail with the following message for hours:
sshd: Received disconnect from 49.86.192.105: 11: Bye Bye [preauth] I cannot really tell what is going on there. Two options seem plausible. 1) The host tries to authenticate with a password. It notices that this method is unavailable and disconnects. 2) The host tries to brute force ssh keys. Upon discovering that this particular ssh key is not authorized it disconnects. In either case denyhosts should block such a host after a while. I am interested in a quick solution or workaround, because this makes denyhosts basically dysfunctional for me. But I recognize that this is a kind of special setup and thus file the report as normal. Helmut -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
