Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteDenyHosts is a Python daemon that watches SSH authentication failures and records abusive hosts so they can be denied through the host-access controls traditionally provided by /etc/hosts.deny. On a Linux VPS, the safe installation sequence is: install the ipaddr dependency, create and edit /etc/denyhosts.conf, whitelist your administration address, choose SSH thresholds, start the daemon, and verify its log. Set a purge policy so old blocks do not accumulate forever.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What DenyHosts does—and what it does not do
The maintained project describes DenyHosts as a utility developed by Phil Schwartz and maintained by a number of developers to thwart brute-force attacks against sshd. It monitors authentication failures generated by the SSH server, counts attempts by source address, and adds offending hosts to the deny mechanism configured on the machine. On traditional Unix-like systems that mechanism is /etc/hosts.deny, interpreted by services that support host-access controls.
As an Amazon Associate I earn from qualifying purchases.
DenyHosts is therefore a response system, not an SSH replacement. It does not make a weak password strong, repair a compromised account, or guarantee that every SSH implementation will consult hosts.deny. Treat it as one layer in the VPS security design. Test the behavior with a second administrative path before you rely on it, and keep a provider console or recovery channel available in case your own address is blocked.
Requirements and a pre-installation safety check
- A Linux VPS on which you have root or equivalent administrative access.
- An SSH server producing authentication-failure records that DenyHosts can parse.
- Python and the
ipaddrPython module. The project notes thatipaddris available in many Linux and BSD repositories. - A known-good administrator address or hostname that can be placed in the allowed-hosts configuration before blocking starts.
- A second access route, such as your provider’s serial or web console, for recovery testing.
Write down the public address from which you will administer the VPS. If your ISP, office, VPN, or mobile connection changes addresses frequently, do not blindly whitelist only the current address; instead, plan a controlled allowed-hosts entry that covers the addresses you legitimately use. A mistaken whitelist is safer than discovering that your only SSH route has been denied.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Confirm where the SSH daemon writes authentication failures and where DenyHosts will write its own log. The sample configuration and packaged defaults vary by distribution, so inspect the configuration instead of assuming that every VPS uses the same log filename.
Choose a distribution package or a source installation
Distribution package
Many distributions package DenyHosts and its Python dependency. A packaged Debian installation provides the denyhosts executable, uses /etc/denyhosts.conf as its default configuration, and documents command-line options such as --config, --daemon, --purge, and --migrate. Use your distribution’s package manager to install the DenyHosts package and ipaddr package, then inspect the files it places on disk before enabling the service.
Package names, Python runtime versions, service-unit names, and log paths are distribution-specific. Do not copy a systemd command from another Linux release without first checking the unit installed on your VPS.
Source installation
The project’s source workflow is appropriate when your distribution does not provide a usable package or when you need the release supplied by the project. Download and unpack a release using your normal administrative process, change into the unpacked directory, and run the installer as root:
python setup.py installThe installer requires the ipaddr module. Resolve that dependency from a repository or another approved package source before running the setup command. Avoid installing an unverified Python package into a production VPS merely to satisfy the import; use the package source maintained for your operating system whenever it is available.
After installation, the project instructs administrators to copy the sample configuration to /etc/denyhosts.conf, copy the distributed daemon-control script, set its paths, and make the control script executable by root. The important path variables are:
Recommended Free Tools
DENYHOSTS_BIN: the installed DenyHosts executable.DENYHOSTS_LOCK: the lock-file path used to prevent conflicting daemon instances.DENYHOSTS_CFG: the full path to the configuration file.
Keep ownership and permissions restricted to root where the control script or configuration contains operational details. Before starting the daemon, confirm that the executable path in the script matches the path created by your Python installation.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Create and review /etc/denyhosts.conf
The configuration file must exist before startup. On a packaged Debian system, the documented default is /etc/denyhosts.conf; a source installation requires you to create that file by copying the supplied sample. Open it as root and review every path that refers to SSH logs, the DenyHosts log, state files, and lock files.
Use the sample’s spacing and variable names exactly. DenyHosts configuration is not a generic INI file: changing a variable name, inserting a typo, or leaving a required path unset can cause the daemon to start without enforcing the policy you intended.
Limit enforcement to SSH
Set the service scope explicitly:
BLOCK_SERVICE = sshdThis setting limits blocking to SSH. The sample also documents:
BLOCK_SERVICE = ALLALL is available when you intentionally want every supported service blocked, but it has a much wider impact and should not be selected merely because it is present in the sample. For a VPS whose immediate objective is stopping SSH brute-force attempts, sshd is the narrow, auditable choice.
Understand the attempt thresholds
The sample configuration contains these defaults:
| Setting | Sample value | Meaning |
|---|---|---|
DENY_THRESHOLD_INVALID |
5 | Invalid-user attempts needed before a host is denied. |
DENY_THRESHOLD_VALID |
10 | Failures involving a valid account name before denial. |
DENY_THRESHOLD_ROOT |
1 | Root-login failures before denial. |
DENY_THRESHOLD_RESTRICTED |
1 | Failures for accounts marked as restricted before denial. |
These numbers are sample defaults, not universal requirements. A threshold of one for root or restricted accounts is deliberately aggressive: a single failed attempt can deny the source address. Lower values react faster but increase the chance that a mistyped credential, a shared NAT address, or a monitoring system triggers a block. Higher values tolerate more mistakes while giving an attacker more attempts.
Record any threshold changes in your operations notes. When investigating a block, the threshold in effect at the time matters more than the values currently shown in the file.
Whitelist administrators before enabling blocking
Allow your trusted management addresses before you start the daemon. The allowed-hosts mechanism is the most important protection against locking yourself out. Add the address, network, or carefully chosen hostname used by your administrators according to the syntax shown in the sample configuration.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
The sample sets:
ALLOWED_HOSTS_HOSTNAME_LOOKUP = NOWith hostname lookup disabled, DenyHosts does not resolve allowed entries to verify names. This avoids dependence on DNS during a security decision and makes the behavior easier to predict. If you enable hostname lookup, understand which DNS resolver the VPS uses and the consequences of a changed or unavailable DNS record. Do not whitelist a hostname you do not control.
After saving the allowed-hosts entries, test that the file is readable and that your current source address appears exactly as intended. Keep an existing SSH session open while you start the daemon and establish a second session from the same trusted address. Only close the original session after the second one succeeds.
Start DenyHosts in daemon mode
You can use the project’s daemon-control script after setting DENYHOSTS_BIN, DENYHOSTS_LOCK, and DENYHOSTS_CFG. The documented direct form is:
python /usr/local/bin/denyhosts --config /etc/denyhosts.conf --daemonIf your installation placed the executable somewhere else, substitute that verified path rather than guessing. The --config option makes the configuration explicit, and --daemon tells DenyHosts to remain active and monitor new authentication failures.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteSome distributions ship a systemd service unit. The project release history records the addition of a systemd unit, but the unit name and location are not universal. List the units installed by your package, inspect the unit’s configured executable and configuration path, and use that distribution-specific unit only after confirming it starts the same daemon you tested manually.
Verify that the daemon is actually working
Starting a process is not proof that SSH events are being parsed. Check the DenyHosts log, typically /var/log/denyhosts, using the exact path shown in your configuration:
tail -f /var/log/denyhostsLook for startup information, the selected configuration file, the monitored SSH log, and messages showing that the daemon is processing entries. If the log remains empty, stop and investigate rather than lowering thresholds. The usual causes are an incorrect SSH-log path, insufficient permission to read that log, a missing ipaddr module, or a configuration syntax error.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Confirm the process and its owner with your operating system’s process tools, then make one controlled failed login from a disposable test address if your test environment allows it. Never generate repeated failures from your own whitelisted administrator address. The goal is to verify parsing and state updates without creating a real lockout.
Configure automatic expiry with purge settings
Permanent blocks can become an operational problem when addresses are reassigned, when a user travels, or when a shared network was incorrectly identified. Set PURGE_DENY to a duration when you want timestamped deny entries to expire. Examples documented by the project include:
PURGE_DENY = 1w
PURGE_DENY = 5dThe value expresses a period such as one week or five days. Choose a period that matches your threat model and incident-response capacity. A short period reduces accidental lockout duration but allows a persistent attacker to try again sooner; a long period provides stronger continuity of the block but requires a reliable recovery process.
To expire eligible entries on demand, run the documented purge operation:
denyhosts --purgeUse the distribution’s equivalent executable path if denyhosts is not on your shell’s PATH. In daemon mode, DAEMON_PURGE = 1h controls how often the purge mechanism runs when purging is enabled. The interval is separate from the age in PURGE_DENY: one determines how old an entry must be, and the other determines how often DenyHosts checks.
PURGE_THRESHOLD can limit how many times an address is purged before it remains denied. This is useful when an address repeatedly returns after temporary expiry. Set it only after you understand how the project records blocked-host history, because an overly strict value can make recovery harder for a legitimate address.
Safely remove or recover a blocked address
First identify the exact address and confirm that you still have an alternative path into the VPS. Do not delete a block merely because a login failed; verify the source address in the DenyHosts state and log files and distinguish your own address from an attacker or a shared gateway.
- Use the provider console or an already-open administrative session if the address is blocked.
- Inspect the DenyHosts log and blocked-host tracking files to confirm the address and the reason it was denied.
- Add the trusted address to the allowed-hosts mechanism so the same lockout cannot recur.
- Run the documented purge/removal procedure for your installed release, or wait for the configured
PURGE_DENYperiod if the entry is timestamped and eligible. - Restart or reload the daemon only if the release instructions require it, then test a new SSH connection from the recovered address.
The project’s FAQ describes purge behavior and blocked-host tracking; follow the syntax supplied by the version installed on your VPS rather than deleting arbitrary lines from state files while the daemon is running. Preserve a copy of the relevant log entry for incident review before removing it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Troubleshooting common installation failures
The daemon exits immediately
- Check that
/etc/denyhosts.confexists and is readable by the account starting DenyHosts. - Verify that the configured SSH log exists and is readable.
- Confirm that the
ipaddrmodule imports successfully in the Python environment used by the executable. - Run the executable with the explicit
--configpath so a second, empty configuration is not selected accidentally. - Read the DenyHosts log and the operating system service log for the first error, not only the final exit message.
SSH failures are not being counted
Check that the SSH daemon’s log format and location match what the installed DenyHosts release expects. A distribution migration, a change in logging service, or a permission adjustment can leave the daemon running while it receives no usable entries. Confirm that new test failures appear in the SSH log first, then verify that DenyHosts reads that same file.
Your legitimate address was denied
Use the console or an existing session, identify the address in the DenyHosts log, add it to the allowed-hosts configuration, and remove or purge the stale denial using the documented release procedure. Review the threshold that was crossed and whether a shared NAT address caused several users’ failures to be attributed to one source.
Old entries never disappear
Check that PURGE_DENY is set to a valid duration, that the entries carry timestamps recognized by the installed release, and that you are running denyhosts --purge with the same configuration file used by the daemon. If automatic purging is expected, verify DAEMON_PURGE and inspect the log for purge activity.
Optional integrations and features
The configuration includes optional integration with PF tables and iptables, plugin hooks, custom regular expressions for failed entries, email reporting, and synchronization settings. Enable one feature at a time and document the resulting firewall or notification change. A host-access deny list and a packet-filter rule are different enforcement layers; combining them can improve containment but also creates more recovery points to audit.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Release notes describe synchronization-server support and invalid-account detection. Synchronization upload and download are opt-in, not an automatic requirement for local blocking. Evaluate the privacy, trust, retention, and operational implications before enabling synchronization, especially on a VPS that handles customer or regulated data.
Operational checklist for a production VPS
- Install the distribution package or complete the source install as root.
- Verify the
ipaddrdependency and the executable path. - Create
/etc/denyhosts.confbefore startup. - Set
BLOCK_SERVICE = sshdunless you have deliberately chosen broader enforcement. - Review all four threshold values rather than assuming the sample defaults fit your users.
- Whitelist every legitimate administration address before enabling the daemon.
- Keep a provider console or other recovery path available.
- Start with
--config /etc/denyhosts.conf --daemonor the verified distribution service unit. - Check the configured DenyHosts log, typically
/var/log/denyhosts. - Set
PURGE_DENY, decide whether to useDAEMON_PURGE, and document the recovery process. - Test a controlled failure from a disposable source without testing against a trusted administrator address.
Where DenyHosts fits in an SSH-defense plan
DenyHosts is attractive when you want a focused SSH log watcher with threshold-based decisions, an explicit allowed-hosts list, and time-based purging. Its enforcement traditionally operates through host access controls, so its effectiveness depends on the SSH service and platform honoring that mechanism. Its service scope, parser coverage, package maintenance, whitelist behavior, recovery controls, and purge semantics are the right criteria to examine if you later evaluate another SSH defense.
No authoritative performance benchmark establishes that DenyHosts blocks a fixed percentage of attacks or outperforms every alternative. Its documented value is operational: it turns repeated authentication failures into address-based denials that administrators can inspect, expire, and recover. Keep the configuration narrow, protect the administrator allowlist, monitor the log, and treat every automated block as a reversible security decision.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
