24

I am trying to unblock an IP from which I was doing some tests. I have followed the tutorials on the net:

$ sudo /etc/init.d/denyhosts stop
$ sudo vim /etc/deny.hosts
[remove the last line where I can see my IP to clear]
$ cd /var/lib/denyhosts/
$ sudo vim *
[remove any occurences of my IP to clear]
$ sudo /etc/init.d/denyhosts start

At this moment my IP appears back into /etc/deny.hosts. I tried also:

$ cd /var/lib/denyhosts/
$ echo '123.456.789.122' >> /var/lib/denyhosts/allowed-hosts

I also tried:

$ echo 'my.ip.to.clear' >> /etc/hosts.allow

Unfortunately the hosts.deny always takes precedence, and refuse ssh connection, as can be seen from the log file:

Feb 10 10:06:24 ks123456 sshd[22875]: refused connect from 123.456.789.122 (123.456.789.122)

ref: debian/6.0.4, denyhosts 2.6-10

9 Answers 9

37

This worked for me on Centos. Follow the 8 steps below and you should be good to go.

  1. Stop DenyHosts

    # services denyhosts stop

  2. Remove the IP address from /etc/hosts.deny

  3. Edit /var/lib/denyhosts/hosts and remove the lines containing the IP address. Save the file.

  4. Edit /var/lib/denyhosts/hosts-restricted and remove the lines containing the IP address. Save the file.

  5. Edit /var/lib/denyhosts/hosts-root and remove the lines containing the IP address. Save the file.

  6. Edit /var/lib/denyhosts/hosts-valid and remove the lines containing the IP address. Save the file.

  7. Edit /var/lib/denyhosts/users-hosts and remove the lines containing the IP address. Save the file.

(optional) Consider adding the IP address to /var/lib/denyhosts/allowed-hosts

  1. Start DenyHosts

    # services denyhosts start

5
  • For step 7, the file is "users-hosts" on my machine, not "user-hosts".
    – Gazzini
    Apr 17, 2014 at 15:36
  • 2
    Works for me. What I don't get is why denyhosts blocks the IP in the first place, and why other IPs which are listed in said files can are not! May 7, 2014 at 21:32
  • FYI for my machine (an amazon-linux machine), the dir was /usr/share/denyhosts/data
    – Scott
    Oct 23, 2017 at 15:26
  • I used "service" instead of "services". Also it was necessary to remove lines with the IP address from /etc/hosts.deny Sep 21, 2018 at 7:16
  • Update on my comment above, look in both /usr/share/denyhosts/data and /var/lib/denyhosts
    – Scott
    Jun 4, 2019 at 16:29
9

The instructions to remove an entry for denyhosts can be found here: http://www.cyberciti.biz/faq/linux-unix-delete-remove-ip-address-that-denyhosts-blocked/. In Ubuntu the denyhosts data files are located at /var/lib/denyhosts.

  1. Make sure there are not entries that represent the domain name for your IP address in denyhosts.
  2. After removing all occurrences of your IP address, and domain name from /etc/deny.hosts (/etc/hosts.deny for Ubuntu) if you are still unable to log in, check the authentication log usually in: /var/log/auth.log It may give you clues to what your problem is.
  3. If you are running linux on both the server and client, you may want to use ssh-copy-id so that you don't need a password to login to prevent locking yourself out by using the wrong password too many times in the future.

I had problems myself because I had a location saved in Dolphin on KDE to my sever using sftp. Dolphin uses your current username to try logging in which was getting my IP added to the hosts.deny file.

1
  • denyhosts is only in 10.04LTS and 12.04LTS. A good alternative which doesn't permanently ban IP addresses which is in the newer repos is fail2ban. It uses iptables by default but can use hosts.deny. Here is a link to the fail2ban homepage.
    – Allen
    Jan 12, 2015 at 18:50
8

Just add the IP that should always have access to the file:

/etc/hosts.allow

That entry could look like:

ALL: 30.20.10.0/24

That way, even if it ends up in /etc/hosts.deny as well, the IP will still have access.

Mind the ALL before the IP, I see you forgot that with your echo statement.

References:

0
7

If instructions above didn't help maybe denyhosts added IP to iptables firewall.

iptables -L -n -v | grep xxx.xxx.xxx.xxx

If you see something like that:

0 0 DROP all -- * * xxx.xxx.xxx.xxx 0.0.0.0/0

Remove required IP from firewall:

iptables -D INPUT -s xxx.xxx.xxx.xxx -j DROP

And restart networking to apply changes:

/etc/init.d/networking restart

4

Adding to an old question, but on Debian Wheezy removing the IP entries did not help: within seconds of running "service denyhost start" the IP would be re-added to hosts.deny and all the files in /var/lib/denyhosts/. It turns out that DenyHosts was re-scanning /var/log/auth.log which included the failed login attempts.

After removing the IP entry from the files listed above, before you restart denyhosts, force auth.log to be archived by running (as root):

logrotate -vf /etc/logrotate.d/rsyslog

Double-check that /var/log/auth.log is empty, then restart denyhosts.

1
  • Thanks! It was the problem in my case. Denyhosts was returning the IP again and again until /var/log/auth.log was cleaned Mar 26, 2018 at 13:44
3

You can do this in 4 commands. It automates the earlier answer from @Abdellatif with a python script, so you should thoroughly glance over the source before pasting these 4 lines into the command prompt (replacing IP_ADDRESS with the ip address):

sudo /etc/init.d/denyhosts stop
git clone  https://github.com/rsprabery/unblock.git
sudo python unblock/unblock.py <IP_ADDRESS>
sudo /etc/init.d/denyhosts start

It should work on all Ubuntu systems. And it's fast. And you don't have to edit any files. But, you are running someone else's script as sudo.

3
  • 1
    I'm not sure using blindly a script found on the internetz is the best recommendation ever, especially when the script is to be used as a sudoer on a server… As opposite to your suggestion such a procedure should be proposed only to people who are curious enough to read the script before using it. Feb 3, 2015 at 9:42
  • And you really don't have to be "curious about how it all works" here, but just to remove a line from a couple of files. Feb 3, 2015 at 9:43
  • @SkippyleGrandGourou I updated the answer to address some of your concerns. I never intended them to blindly run the script, that's why I linked to the source. Also, "A couple of files" is actually 6 files. But, the word "curious" was poorly chosen. Good call.
    – Gazzini
    Feb 3, 2015 at 18:33
3

Here's what worked for me on CentOS 6.7

  1. Stop DenyHosts (ver 2.6) ./daemon-control stop
  2. Remove line/s with your/target IP address from /etc/hosts.deny
  3. Remove line/s with your/target IP address from /usr/share/denyhosts/data/hosts
  4. Remove line/s with your/target IP address from /usr/share/denyhosts/data/hosts-restricted
  5. Remove line/s with your/target IP address from /usr/share/denyhosts/data/hosts-root
  6. Remove line/s with your/target IP address from /usr/share/denyhosts/data/hosts-valid
  7. Remove line/s with your/target IP address from /usr/share/denyhosts/data/users-hosts
  8. ADD your/target IP address to /usr/share/denyhosts/data/allowed-hosts. This file simply expects one IP per line. Any IP address that appears in this file will not be blocked.
  9. Start DenyHosts ./daemon-control start
1
  • 1
    The above works for denyhosts installed from source. For installation from the rpm, the service control is done via service denyhosts start/stop, and the data files are in /var/lib/denyhosts/ instead of /usr/share/denyhosts/data/. Dec 5, 2017 at 18:04
2

Ubuntu 18.04

IP_UNBLOCK='1.2.3.4'
systemctl stop denyhosts
sed -i -e "/$IP_UNBLOCK/d" /etc/hosts.deny
sed -i -e "/^$IP_UNBLOCK/d" /var/lib/denyhosts/hosts
sed -i -e "/^$IP_UNBLOCK/d" /var/lib/denyhosts/hosts-restricted
sed -i -e "/^$IP_UNBLOCK/d" /var/lib/denyhosts/hosts-root
sed -i -e "/^$IP_UNBLOCK/d" /var/lib/denyhosts/hosts-valid
sed -i -e "/$IP_UNBLOCK/d" /var/lib/denyhosts/users-hosts
sed -i -e "/^$IP_UNBLOCK/d" /var/lib/denyhosts/hosts-root
sed -i -e "/refused connect from $IP_UNBLOCK/d" /var/log/auth.log
sed -i -e "/from $IP_UNBLOCK port/d" /var/log/auth.log
iptables -D INPUT -s "$IP_UNBLOCK" -j DROP
ufw reload
systemctl start denyhosts

and run this before you install denyhosts

echo "All:" $(last -i | grep -v '0.0.0.0' | grep 'root' | head -1 | awk '{print $3}') >> /etc/hosts.allow
0

Nothing worked but Answer by Oleksandr Shmyheliuk

Used following two commands

iptables -L -n -v | grep 49.33.135.137

if there is output then use following command

iptables -D INPUT -s 49.33.135.137 -j DROP 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.