Peering To Parent

[josev814]

I know right now that peering is supported within your own infrastructure. Would we be able to get peering activated to a centralized cloud server?

So, we could have internal organization servers peer to each other. Then they can set a primary server of their internal sync servers set to sync to a cloud server. That way they can sync internally, but also sync externally in order to allow other users to get their blocked hosts or pull-down ips that they don't have. Also, it would help to reduce the connections needed to push to the external sync server.

Current DenyHosts setup:
Host 1 -> sync.denyhosts.org
Host 2 -> sync.denyhosts.org
Host 3 -> sync.denyhosts.org

Proposed setup:
Host 1 -> internal.sync.host
Host 2 -> internal.sync.host
Host 3 -> internal.sync.host
Host 4 -> internal2.sync.host
Host 5 -> internal2.sync.host
Host 6 -> internal2.sync.host
internal.sync.host <-> internal2.sync.host (internal peering)
internal.sync.host <-> sync.denyhosts.org (external sync)

[janpascal]

This could be doable, but it would mean some significant work both in programming and in thinking out the implications. Right now, peering means sharing all information between servers and fully trusting what is sent. Usually when a report is received by a single participating client, it is not directly regarded as a threat until the report is confirmed. Your 'internal.sync.host' could receive multiple such reports and sync them to sync.denyhosts.org, which would then flag the reported host as a threat. This opens the door for abuse, since then every internal sync host could blackhole any address they wish by faking multiple reports about the same host.

It may be doable to think out a way to do this properly, but that would take some thinking time :)

[josev814]

What I was thinking is that there could be a flag "quota" set on the external sync server. So, if we are receiving from x amount of clients from different geo-locations. Take x * 10%. If 10% of those clients have flagged the ip, then it should be included in the syncing of blocked ips. I know we're getting the ips of the blocked servers. I'm not sure we're capturing the ip of the server syncing. If we're not, it could still be an x amount of client, but the percentage that has flagged the ip should be a higher percentage.

[josev814]

Within the DenyHosts application the config has a setting for SYNC_DOWNLOAD_THRESHOLD and SYNC_DOWNLOAD_RESILIENCY. Resiliency is off by default, but the threshold isn't.

So regarding the parent server syncing to the child servers on internal networks, I think we could implement the same setting into the sync server.

The other option would be to allow all crackers to sync between the child/parent. Then allow each individual DH app to pull from the db what it wants.

I think giving the administrator the option to set those settings on the sync server would be a good idea though.