Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am a new server admin. I just setup fail2ban on an ubuntu 12.04 VPS. I used this tutorial. Then I tried to login to the system via ssh from a friend's machine. It is showing "operation timed out." It seems like this means fail2ban is working -- but I want to double check to be certain. Is this what it looks like on the client side when fail2ban has blocked your IP? Your SSH login times out because fail2ban/iptables does not allow it to initiate on the server side?

$ ssh -p# user@IP
user@IP's password: 
Permission denied, please try again.
user@IP's password: 
Permission denied, please try again.
user@IP's password: 
^C
$ ssh -p# user@IP
ssh: connect to host IP port #: Operation timed out
$ ssh -p# user@IP
ssh: connect to host IP port #: Operation timed out
share|improve this question
    
felipeferreira.net/?p=47. That looks correct to me. –  slm Mar 22 at 15:01

1 Answer 1

up vote 4 down vote accepted

If you take a look at this tutorial it states you'll see a timeout which is consistent with what you're seeing, titled: Fail2ban - Rackspace Knowledge Center.

excerpts

Let's test fail2ban to make sure it behaves the way we want it to. We'll do that by failing a few ssh logins.

We'll use two machines: The server we want to protect and another machine to act as the attacker.

  • Attacking machine's IP: 123.45.67.89
  • The server's IP: 98.76.54.32

To run the test, simply get on the attacking machine and try to ssh to your server five times. For example:

   $ ssh fakeuser@98.76.54.32

With the sixth try (assuming you have ssh's maxretry set to 5) your connection should time out if you try to ssh in again.

NOTE: This last sentence is what you're seeing!

Also you can setup fail2ban to send an email similar to this:

If you have fail2ban set to send you email check to see if you got a message like this one:

    From fail2ban@ITSecurity  Thu Jul 16 04:59:24 2009
    Subject: [Fail2Ban] ssh: banned 123.45.67.89
    Hi,

    The ip 123.45.67.89 has just been banned by Fail2Ban after 5 attempts 
    against ssh.

    Here are more information about 123.45.67.89:

    {whois info}

    Lines containing IP:123.45.67.89 in /var/log/auth.log

    Jul 16 04:59:16 example.com sshd[10390]: Failed password for root from 123.45.67.89 port 46023 ssh2
    Jul 16 04:59:18 example.com sshd[10390]: Failed password for root from 123.45.67.89 port 46023 ssh2
    Jul 16 04:59:20 example.com sshd[10390]: Failed password for root from 123.45.67.89 port 46023 ssh2
    Jul 16 04:59:21 example.comsshd[10394]: reverse mapping checking getaddrinfo for 123.45.67.89.example.com [123.45.67.89] failed - POSSIBLE BREAK-IN ATTEMPT!
    Jul 16 04:59:22 example.com sshd[10394]: Failed password for root from 123.45.67.89 port 46024 ssh2

    Regards,

    Fail2Ban

Probably the best indication though that fail2ban worked was the existence of a new iptables rule that's now blocking the attacking IP address.

For example:

iptables -L 

Chain fail2ban-ssh (1 references)
target     prot opt source               destination
DROP       all  --  208-78-96-200.realinfosec.com  anywhere
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.