How to test if the denyhosts can send me an email?

Question

The denyhosts service is supposed to analyse my logs and tell me if someone is trying to brute force my sshd. It should deny them access and send me an email. How do i know if it is working? In particular, can I get it to send me a test email so that I know that it actually has the right address and configuration.

I strongly suspect it can't send me an email, since there is no sendmail on this box.

Answer 1

It seems that denyhosts requires a SMTP server to be configured in denyhosts.cfg – it does not support the standard /usr/sbin/sendmail interface.

Try running denyhosts --foreground, also check syslog and/or the configured log file.

You can also use this script to send a test email; run it using sudo -u denyhosts:

#!/usr/bin/env python
import sys
sys.path.insert(0, '/usr/share/denyhosts')
from DenyHosts import constants, prefs, util
prefs = prefs.Prefs(constants.CONFIG_FILE)
util.setup_logging(prefs, True, False, False)
util.send_email(prefs, "This is a test.")

---

FYI: here "sendmail" does not refer to the Sendmail MTA specifically, but rather to the executable program in /usr/sbin (sometimes /usr/lib), which is installed by any MTA – not just Sendmail, but also Postfix, Exim, and others.

Answer 2

To get DenyHosts to send you a test email.

1. Login to your Linux system containing the sshd server and switch to root user.
2. Append the following line to the file /etc/hosts.deny - sshd: 127.0.0.1
3. Save the file
4. Attempt to connect to the local sshd server: - $ ssh localhost (if you are connecting on a port other than 22, use the -p switch)
5. You should receive the following error message: - ssh_exchange_identification: Connection closed by remote host
6. You should also have been sent an email from DenyHosts [Nobody@yourserver]
7. Remember to remove the line you added to the file /etc/hosts.deny - save the file.