I installed denyhosts quite a while ago after being hacked. I have had no issues, but haven't been doing a lot on the box. Now, when I am just sitting browsing the web I will get kicked from WinSCP. When I click to reconnect, it returns "Server unexpectedly closed network connection." Sure enough I use putty to get in (why this wouldn't be banned I am unsure) and sure enough my ip is added to deny.hosts. I remove it and click reconnect and it works. Any ideas?

Thanks,
John

Does your putty session connect to your linode console and not via ssh?

Actually, that seems fair since it logs in it is going to my dallas.linode rather than the ip/hostname that the WinSCP session is pointing.

However, this doesn't help me on the issue of being banned in the first place. Correct?

If WinSCP is using its background transfer feature, it will open several ssh connections, which might cause denyhosts to trip.

You can configure denyhosts to never deny your own IP address. You can use this feature if your IP address doesn't change a lot.

http://denyhosts.sourceforge.net/faq.html#allowed

But it's probably the way you're connecting to your server that's causing the problem in the first place. Does your WinSCP open several new connections at the same time, for example to transfer several files simultaneously? That might make denyhosts nervous, depending on your configuration...

That is a good idea. My only concern (after being hacked and having to restart already) is that there is someone else trying to get in again. I have Webmin running and I see there is a backup option in there. Anyone have a recommendation on the best way to back up an entire box? Hopefully even including MySQL DBs, etc?

Backup your /etc, /var/log, your /home/*, /root directory and your website location generally /var/www, or /var/sites.

Backup as in tar them all up and download them, or email them to your gmail account or something.

I think mysql is stored in /var/mysql, but it is better to dump the database to a text file and import them back in later. PhpMyAdmin can do this easily

Good luck.

I checked, and the default location for MySQL data seems to be /var/lib/mysql (I checked this on two different distros; Debian and Gentoo).

Thanks