Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have my ssh port changed to XXX. Then I did

ufw limit XXX/tcp

However, when I try to login, after 5/6 failed attempts I get thrown back to prompt, but I can try again. Is that supposed to be the way it works?

share|improve this question
The example in the man page is ufw limit ssh/tcp – jasonwryan Dec 29 '11 at 3:17
@jasonwryan, it says it will deny IP who tried connecting >6 times in the last 30sec. But I can keep trying? – Jiew Meng Dec 29 '11 at 6:53
Did you try with ssh/tcp? Is ufw running? – jasonwryan Dec 29 '11 at 8:04
@jasonwryan, But I changed the port to XXX (a number of course, just dont think I should declare what port I use here :)). So I think I should be using LIMIT XXX/tcp instead of LIMIT ssh/tcp? – Jiew Meng Dec 29 '11 at 9:13
Yes: I read your question. My reading of the man page is that it limits the service irrespective of the port that it listens on. It can't hurt to try it, can it? – jasonwryan Dec 29 '11 at 9:51
up vote 2 down vote accepted

If I understand your description correctly, you're typing ssh myserver.example.com and making a few failed attempts, and getting your local prompt back. That is still one TCP connection, so it counts for one against ufw limit (the firewall doesn't know anything about authentication attempts, it works at a lower level). You need to make 6 separate ssh connections within 30 seconds to trigger the limit.

share|improve this answer
Oh I got it now. Is it possible to limit the user to try 3 times (not the TCP connections). Perhaps I need denyhosts for that? Is there an alternative (just for my information) – Jiew Meng Dec 30 '11 at 3:28
@jiewmeng The number of permitted authentication failures in one SSH connection has to be managed by the SSH daemon, it can't be managed at the TCP level. Set MaxAuthTries in sshd_config. – Gilles Dec 30 '11 at 16:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.