Patching denyhosts to allow correct plugin reporting
This is a copy of an article I have recently had published on www.debian-administration.org
Imagine you have denyhosts installed and it is adding new attackers to /etc/hosts.deny. Wouldn't it be great to inform the relevant people so that some action could be taken? With the right plugin that is possible, but there is a problem with the default reporting that we'll explain here.
That's what Automatically Report all SSH Brute Force Attacks to ISPs is all about. It grabs the IP, does some whois/lookup magic and sends off some e-mails.
So I installed it and left it running. This morning I find that one IP has hit and been correctly sent (and a reply received thanking me for the info and informing that the host has been closed down). Great! But - what's this - another 58 IPs were also reported to the plugin - causing a further 127 mails to go out. What's going on?
###Finding the bug
First hit - the Debian Bug Tracker. Here we find bug #430449 - over a year old but the correct symptom.
Having filed a follow-up I took a look at the code of denyhosts itself - and found a suspicious looking call to the deny plugin.
Finally - a trawl through the upstream bug tracker to find the same issue there.
###Patching the system
OK - so - it's a bug, and its an upstream bug. That's good - it means that we can have a hope of a fix. But - we need to fix our own system in the meantime.
You could just edit the python file directly - but - what if you have several systems running this version of denyhosts?
Let's build a Debian package containing the fix.
####Step 1 - grab the source
apt-get source denyhosts
####Step 2 - make sure we have the build dependencies
apt-get build-dep denyhosts
####Step 3 - Patch the source
Make the code changes you want
####Step 4 - Update changelog file for version
You need to update the version so that new versions/security updates etc will still work. The version is stored in debian/changelog as the first line.
I added:
denyhosts (2.6-1etch1chris1) stable; urgency=low
* Local build for fix to 430449
-- Chris Searle <[email protected]> Thu, 17 Jul 2008 11:06:15 +0200
2.6-1etch1chris1 is a later version than 2.6-1etch1 (the current version) and an earlier version than 2.6-1etch2 or 2.6-2 which are the likely next version numbers.
####Step 5 - Build
In the root of the package directory structure that was created by the call to apt-get source run the following:
dpkg-buildpackage -uc -us -rfakeroot
The -uc and -us are to prevent signing - we are not the package maintainer.
The -rfakeroot allows us to run as non-root.
####Step 6 - Install
There should be a new .deb file one directory up - mine is called denyhosts_2.6-1etch1chris1_all.deb
dpkg -i denyhosts_2.6-1etch1chris1_all.deb