Allowing an entire subnet on Ubuntu server 11.10

Question

I am trying to allow all hosts in my subnet to connect to a server I have running in VirtualBox with ssh. I have tried several different methods so far, none of which have made any progress. What I want is to allow all hosts on my subnet to attempt to login without being blocked after an arbitrary number of failed attempts. (As of right now it takes 6 attempts for me to be blocked.) Every method I have found online so far has not worked. Many of them are very similar but I tried them anyway. None of them worked. I am using a NAT network setting. I have port forwarding already set up. What i need to be able to do is allow a user, whether valid or not, to attempt to login as many times as they wish without blocking the IP they are attempting to login from.

When I attempt to login to my virtual system from my host system the IP that gets blocked is 10.0.2.2

When I run ifconfig the ip address that shows is 10.0.2.15/24

I have tried these different methods:

For the /etc/hosts.allow file I have tried

sshd: 10.0.2.
ALL: 10.0.2.
sshd:10.0.2.2
sshd: ALL: 10.0.2.15/24
sshd: 10.0.2.15/24 :ALLOW

For the /etc/hosts.deny file I have tried

ALL: ALL
sshd: ALL

Can anyone explain to me how to get this to work? Every method I have tried above still blocks me after 6 failed attempts

Any help, tips, or suggestions will be greatly appreciated!

Answer 1

I think you have two problems:

1. You need to be using bridged networking for the VM, not NAT.

   If you do a packet capture on the guest VM when it's configured with a NAT-based virtual Ethernet adapter, you'll find that packets are coming into the VM from the IP of the host's virtual Ethernet adapter, not from the client machines' IPs, 10.0.2.x. This Network Address Translation (NAT) prevents your TCP Wrappers from doing what you want, because it prevents you from distinguishing connections by source address.

   Bridged networking connects the VM directly to the physical LAN, so it can use the same IP scheme as other hosts on the LAN. The VM host just passes packets for the VM's IP straight through to the VM without translation in this mode.

2. I think you're chasing the wrong thing by changing the TCP Wrappers configuration files. (/etc/hosts.*) While those do let you configure conditional denials, to the best of my knowledge there's nothing in TCP Wrappers that lets you say "deny after X failures." It just lets you define rules that cause any given connection to be denied or allowed without reference to prior events.

   I just installed a fresh Ubuntu 11.10 VM here, then tried logging in with a bad password dozens of times. It's still accepting attempts; it hasn't locked me out yet.

   If I'm right, your six-failure lockout behavior is caused by something else, like fail2ban, Denyhosts, a firewall, etc.