denying spam hosts ssh access - good idea?

[Anton Shterenlikht]

On Mon, Jan 11, 2010 at 07:18:04AM -0700, Tim Judd wrote:
> On 1/11/10, David Southwell <david at vizion2000.net> wrote:
> >> I'm thinking of denying ssh access to host from which
> >> I get brute force ssh attacks.
> >>
> >> HOwever, I see in /etc/hosts.allow:
> >>
> >> # Wrapping sshd(8) is not normally a good idea, but if you
> >> # need to do it, here's how
> >> #sshd : .evil.cracker.example.com : deny
> >>
> >> Why is it not a good idea?
> >>
> >> Also, apparently in older ssh there was DenyHosts option,
> >> but no longer in the current version.
> >> Is there a replacement for DenyHOsts?
> >> Or is there a good reason for such option not to be used?
> >>
> >> many thanks
> >> anton
> >>
> > I use denyhosts ( /usr/ports/security/denyhosts ) works well for me. I also
> > use blackhole and sshguard
> >
> > david
> 
> 
> I've been meaning to check this out.  My firewall ssh rules are very
> strict, in fact, if the remote IP is "unknown" meaning, I don't know
> where the heck it's coming from, it's blocked.  It's easier to say it
> this way:  I allow ssh connections from IPs I know, preferably static
> IPs.
> 
> Given that there are more than one general blacklists out there that
> list unwanted behavior, and that we have ports that make use of these
> lists, I wonder if we can use a list (in this case, for spam)
> effective for blocking ssh connections.  This means:
>   install spamd
>   setup pf (requirement for spamd, it is built by OpenBSD after all)
>   in the pf rules, block *ANYTHING* coming from the blacklisted IPs
> 
> 
> I don't know how effective it is, but since the spamd blacklist IPs
> are hosted on what seems to be only one server/server farm, I am also
> looking for any way I can provide a mirror (even if it's slightly
> outdated) of this data.

I'm very grateful for all advice, but I'm still unsure
why denying ssh access to a particular host via /etc/hosts.allow
is a bad idea.

many thanks
anton

-- 
Anton Shterenlikht
Room 2.6, Queen's Building
Mech Eng Dept
Bristol University
University Walk, Bristol BS8 1TR, UK
Tel: +44 (0)117 331 5944
Fax: +44 (0)117 929 4423