2

So, I installed (and configured) fail2ban on three Ubuntu VPS servers. I configured (imo) a maximum of 3 failed login attempts (via Putty as root) within 2 minutes. Then I restarted the fail2ban service (according to this manual).

But when I look at my auth.log files in /var/log/ I still see 4, 5 or more failed attempts from certain IP's. So obviously I did something wrong as the IP is not blocked after 3 failed attempts.

It might have to do something with iptables, but that's where it gets a bit "foggy" for me..

Not sure how to setup a max-three-failed-login-attempts rule..

Additional: I see that the login attempts mostly have different ports for every attempt. Does that influence the count to max-three?

Because I see a port being "poked" twice and then no more attempts. Then the IP tries a different port (again 2 times). (all bots of course)

2

fail2ban uses iptables to block (assuming you're using the default iptables-multiport "action" in f2b). iptables is just part of Linux, so isn't something you need to install.

By Ubuntu defaults, if you look in /etc/fail2ban/jail.conf, you should see something like this:

[ssh]

enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 6

So before we go any further, the default is 6 failed attempts before blocking, not 3. You can lower this here if you wish. That seems like it would answer your question.

But past that, check that /etc/services has the right port for your SSH server. I think this is where f2b is looking up port numbers (when you specify a port for a jail - as is above). If you are running multiple SSH servers on different ports or have multiple ports open for SSH, you might need to adjust what's being used by f2b, or remove the constraint completely.

  • Yes, I see now.. maxretry for ssh was still 6 (now changed to 3). But as the 'howto' adviced, I edit the file "jail.local" instead of "jail.conf" (a copy, as jail.conf can be overwritten during updates). So I have to wait and check logs again if changes were applied. Imo I have one SSH server running, but I do not completely understand your /etc/services part.. – John Doe Feb 27 '15 at 13:23
  • The port definition for the SSH jail is "ssh".. The only resolution I can see from this to an actual port number is via /etc/services but I'm not sure if that's what f2b uses. This might only matter if you're not running on the default port. – Oli Feb 27 '15 at 13:28
  • I just checked all three servers with iptables -L and several of the attacking IP's where added to the 'SSH jail'. So in my humble opinion all is working correctly after I changed the SSH maxretry to 3. So, thanks for the usable and understandable answer.. – John Doe Feb 27 '15 at 13:43
  • @Oli: netfilter is a part of Linux, and it can be a module. ipfilter is not a part of Linux, because it lives outside the kernel - and Linux is just a kernel. – 0xC0000022L Feb 27 '15 at 16:20
  • @JohnDoe: easier to get a full list with would be iptables-save (it prints the list of all rules, no worries, doesn't tinker with the rules like iptables-restore would) – 0xC0000022L Feb 27 '15 at 16:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.