Home › Forums › BlockHosts

Blocking using DNSBL?

Mon, 2007–Jan–29

I was wondering if there was any way to, say, lookup a host on a DNSBL server when they connect to my SSHD server and bar them if they are listed?

‹ ubuntu linux issues - detailed logs provided Consecutive login attempts ›
Mon, 2007-01-29 22:19 — ac

not built in

There is no built in support for blacklisting hosts based on a remote host list such as DNSBL servers. It is always very risky to block a address based on a third-party list - what if the list is incorrect? But I do understand a lot of web services such as spam blockers, email blacklists, are based on such lists - one way to use them with blockhosts is to write a separate standalone script to query a host at a remote site, and then add it immediately to the block list, possibly modifying blockosts itself to make use of such external scripts. This will introduce delays in all SSH activity, and in the end, for this application, may not be worth it - since within a few bad attempts, the IP address is going to be blocked anyway.

I believe the DenyHosts utility does offer a way to share IP address collected at a centralized server, so that may be a better fit for this feature.