sentry, an alternative to fail2ban and other bruteforce blocking daemons
25 Mar 2015
I’ve just migrated my servers from using fail2ban to sentry, and it feels quite efficient =), so I’m doing this post as a way to increase sentry awareness.
Sentry is a program who detects and prevents bruteforce attacks against sshd and other network services using minimal system resources. Instead of running a daemon who constantly reads log files it runs a perl script who uses tcpwrappers for tracking connections and blocking access by ip, tcpwrappers is already installed in most modern UNICES systems (Linux, Mac OSX and FreeBSD). So if you additionally have perl installed it adds 0 dependencies.
Ubuntu | Minos
$ sudo add-apt-repository ppa:minos-archive/main $ sudo apt-get update && sudo apt-get install sentry
$ wget http://www.tnpi.net/internet/sentry.pl $ sudo perl sentry.pl $ echo "sshd : /var/db/sentry/hosts.deny : deny" > hosts $ echo "sshd : ALL : spawn /var/db/sentry/sentry.pl -c --ip=%a : allowsendmail: all" >> hosts $ cat hosts /etc/hosts.allow > hosts.allow $ sudo mv hosts.allow /etc/ && rm hosts
Upon installation it doesn’t require anything else, it’ll just works, to see some statistics run:
$ sudo /var/db/sentry/sentry.pl -r no IP, skip info -------- summary --------- 42 unique IPs have connected 190 times 1 IPs are whitelisted 38 IPs are blacklisted
To see blocked IPs
$ sudo head -3 /var/db/sentry/hosts.deny ALL: 22.214.171.124 : deny ALL: 126.96.36.199 : deny ALL: 188.8.131.52 : deny
The list can be edited either manually or through the –whitelist, –blacklist and –delist sentry.pl options
$ sudo /var/db/sentry/sentry.pl --ip=184.108.40.206 --delist $ sudo /var/db/sentry/sentry.pl --ip=220.127.116.11 --whitelist $ sudo /var/db/sentry/sentry.pl --ip=18.104.22.168 --delist $ sudo /var/db/sentry/sentry.pl --ip=22.214.171.124 --blacklist
That’s it, happy blocking 😋