0

I have had this setup before by a friend of mine but it got lost in a reinstall.

Basically what happened was, whenever someone would directly SSH to my server as root their IP would get blocked, you would have to login using a custom username and use "sudo" in order to get root privileges.

Unfortunatly searching for the usual keywords for this question only teaches me how to disable root login, which is not completely what I want.

My server runs on the latest Debian version.

  • Does this help? – garethTheRed Dec 15 '14 at 19:35
  • does what help? – xorinzor Dec 16 '14 at 19:57
  • The web page that opens when you activate the hyperlink this :-) – garethTheRed Dec 16 '14 at 20:01
  • Oh.. I could not see the color difference in the text there, they should fix that probably. but yes it seems to be the same as the answer so it did in a way :P – xorinzor Dec 16 '14 at 20:06
2

SSHd does not ban IP addresses. Whenever it encounters an authentication failure, it adds an entry to its log, and keeps going. Other pieces of software, however, may read these logs afterwards and ban IPs according to their rules. The most common daemon used for such a task is fail2ban.

Fail2ban works with jails. Each jail is associated to a service, a log file, and follows a specific set of rules. Whenever an IP enters the scope of a jail's rules, it is immediately blacklisted for a given amount of time (also specified in the jail's rules). Here is an example of a fail2ban jail for the SSH service (set in /etc/fail2ban/jail.conf in my case) :

[ssh]
enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 3

Thanks to this rule, if any IP fails to login more than 3 times in 10 minutes, the fail2ban daemon will add it to a iptables chain, resulting in the dropping of all incoming network packets from this IP.

Now, if you consider the following jail...

[ssh]
enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 1
findtime = 60
bantime = -1

... well in this case, any IP which fails to authenticate will be banned permanently. Note that by using a custom filter, it is completely possible to target root logins only. Also remember that root logins are disabled by default for a good reason: the root account shouldn't be available for anyone to connect to directly. It is much safer to login with your username, and then use sudo whenever you need it : this requires intruders to find both the username and the password, while the root username is famous already.

0

Sound like a config issue with the "/etc/ssh/sshd_config". Change the below line from

PermitRootLogin no

To

PermitRootLogin yes

And restart the ssh service

  • Permitting root login is nothing but a way to lower your security. If the user tries to login as root and makes a typo, the ban is likely to be enforced anyway, no matter whether root login is allowed or not. – John WH Smith Dec 15 '14 at 20:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.