With Denyhosts, how can I "whitelist" a known good user by username plus the fact that they have a valid RSA keypair (or in combination with some other known fact about the user such as MAC address)?
Some background:
On a Ubuntu server, denyhosts is blocking some SSH users (but not all) from logging in. The users are all configured exactly the same -- even using the same Linux user account. Every user has an RSA key pair and logs in via keypair only. No password based SSH logins are allowed. (These are automated SSH logins to an update server.)
If I add the problematic users's IP addresses to Denyhost's hosts.allow file (and remove the address from any restricted/deny files), the user can login just like the other users. But none of these users have static IP addresses, so this isn't a solution.
Given the fact that these users have a valid RSA key and they have a Linux user account, is there a way I can make denyhosts stop blocking them (without weaking its proper functioning, especially for all the would-be attackers who try to log in with invalid passwords)?
Update:
I have PasswordAuthentication no and AllowUsers foo@* in /etc/ssh/sshd_config along with the other relevant settings so that my users can only log in with RSAAuthentication.
Of course, I could always stop using Denyhosts. But my question is how can I make Denyhosts work the way I intend so I don't have to stop using it.
