Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to allow all hosts in my subnet to connect to a server I have running in VirtualBox with ssh. I have tried several different methods so far, none of which have made any progress. What I want is to allow all hosts on my subnet to attempt to login without being blocked after an arbitrary number of failed attempts. (As of right now it takes 6 attempts for me to be blocked.) Every method I have found online so far has not worked. Many of them are very similar but I tried them anyway. None of them worked. I am using a NAT network setting. I have port forwarding already set up. What i need to be able to do is allow a user, whether valid or not, to attempt to login as many times as they wish without blocking the IP they are attempting to login from.

When I attempt to login to my virtual system from my host system the IP that gets blocked is

When I run ifconfig the ip address that shows is

I have tried these different methods:

For the /etc/hosts.allow file I have tried

sshd: 10.0.2.
ALL: 10.0.2.
sshd: ALL:
sshd: :ALLOW

For the /etc/hosts.deny file I have tried

sshd: ALL

Can anyone explain to me how to get this to work? Every method I have tried above still blocks me after 6 failed attempts

Any help, tips, or suggestions will be greatly appreciated!

share|improve this question
up vote 1 down vote accepted

I think you have two problems:

  1. You need to be using bridged networking for the VM, not NAT.

    If you do a packet capture on the guest VM when it's configured with a NAT-based virtual Ethernet adapter, you'll find that packets are coming into the VM from the IP of the host's virtual Ethernet adapter, not from the client machines' IPs, 10.0.2.x. This Network Address Translation (NAT) prevents your TCP Wrappers from doing what you want, because it prevents you from distinguishing connections by source address.

    Bridged networking connects the VM directly to the physical LAN, so it can use the same IP scheme as other hosts on the LAN. The VM host just passes packets for the VM's IP straight through to the VM without translation in this mode.

  2. I think you're chasing the wrong thing by changing the TCP Wrappers configuration files. (/etc/hosts.*) While those do let you configure conditional denials, to the best of my knowledge there's nothing in TCP Wrappers that lets you say "deny after X failures." It just lets you define rules that cause any given connection to be denied or allowed without reference to prior events.

    I just installed a fresh Ubuntu 11.10 VM here, then tried logging in with a bad password dozens of times. It's still accepting attempts; it hasn't locked me out yet.

    If I'm right, your six-failure lockout behavior is caused by something else, like fail2ban, Denyhosts, a firewall, etc.

share|improve this answer
Hmmm. Ok. I tried this. What I see is packets coming in from 192.168.x.x at first. Then after the first attempt it switches over to > Every attempt after this comes from these IP's. Any ideas? – Andy Apr 25 '12 at 15:10
Rewrote my answer in light of this, and testing on an actual Ubuntu VM. (Via VMware, not VirtualBox, but I don't see that that difference matters.) – Warren Young Apr 25 '12 at 17:07
Thanks for all the tips Warren. I really appreciate you taking the time to test this out and explain to me what is happening. I will try it on bridged and see what happens. Thanks again! – Andy Apr 27 '12 at 18:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.