1

everything seems ok, iptables shows its blocked, yet I still get auth attempts

I have configured fail2ban

# "ignoreip" can be an IP address, a CIDR mask or a DNS host
ignoreip = 127.0.0.1/8
bantime  = 864000
maxretry = 3

[ssh]

enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 3

fail2ban log shows its already blocked

2016-01-17 06:25:02,218 fail2ban.server : INFO   Changed logging target to /var/log/fail2ban.log for Fail2ban v0.8.6
2016-01-17 06:25:03,275 fail2ban.filter : INFO   Log rotation detected for /var/log/auth.log
2016-01-17 06:25:54,330 fail2ban.filter : INFO   Log rotation detected for /var/log/auth.log
2016-01-19 13:21:33,459 fail2ban.actions: WARNING [ssh] xxx.xxx.xxx.xxx already banned
2016-01-19 13:21:45,472 fail2ban.actions: WARNING [ssh] xxx.xxx.xxx.xxx already banned
2016-01-19 13:22:28,522 fail2ban.actions: WARNING [ssh] xxx.xxx.xxx.xxx already banned
2016-01-19 13:22:38,534 fail2ban.actions: WARNING [ssh] xxx.xxx.xxx.xxx already banned
2016-01-19 13:22:53,550 fail2ban.actions: WARNING [ssh] xxx.xxx.xxx.xxx already banned
2016-01-19 13:23:47,609 fail2ban.actions: WARNING [ssh] xxx.xxx.xxx.xxx already banned
2016-01-20 12:58:54,982 fail2ban.actions: WARNING [ssh] xxx.xxx.xxx.xxx already banned
2016-01-20 12:59:41,030 fail2ban.actions: WARNING [ssh] xxx.xxx.xxx.xxx already banned
2016-01-20 12:59:55,046 fail2ban.actions: WARNING [ssh] xxx.xxx.xxx.xxx already banned
2016-01-20 13:00:06,057 fail2ban.actions: WARNING [ssh] xxx.xxx.xxx.xxx already banned
2016-01-20 13:00:37,091 fail2ban.actions: WARNING [ssh] xxx.xxx.xxx.xxx already banned
2016-01-20 13:01:20,137 fail2ban.actions: WARNING [ssh] xxx.xxx.xxx.xxx already banned

iptables -L -n

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
fail2ban-ssh  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 22
fail2ban-ssh  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 22
ACCEPT     tcp  --  0.0.0.0/0            some_IP_I_need        tcp spts:1024:65535 dpt:port_of_websrv state NEW,ESTABLISHED

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     tcp  --  some_IP_I_need        0.0.0.0/0            tcp spts:1024:65535 dpt:port_of_websrv state NEW,ESTABLISHED

Chain fail2ban-ssh (2 references)
target     prot opt source               destination         
DROP       all  --  xxx.xxx.xxx.xxx      0.0.0.0/0           
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           
RETURN     all  --  0.0.0.0/0            0.0.0.0/0

yet, still some auth requests, why?

Jan 20 12:59:55 pdwhost sshd[659439]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=xxx.xxx.xxx.xxx  user=root
Jan 20 12:59:55 pdwhost sshd[659441]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=xxx.xxx.xxx.xxx  user=root
Jan 20 12:59:57 pdwhost sshd[659439]: Failed password for root from xxx.xxx.xxx.xxx port 43728 ssh2
Jan 20 12:59:57 pdwhost sshd[659439]: fatal: Read from socket failed: Connection reset by peer [preauth]
Jan 20 12:59:57 pdwhost sshd[659441]: Failed password for root from xxx.xxx.xxx.xxx port 43729 ssh2
Jan 20 12:59:57 pdwhost sshd[659441]: fatal: Read from socket failed: Connection reset by peer [preauth]

I typically run services on non standard ports if possible. which makes me also wonder, why does this line show port 22 (ssh is on a different port), is this something i need to change somewhere?

fail2ban-ssh  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 22

also, does it make sense to report this IP? its from choopa.

3

You should try setting

port     = ssh

to the port you really use. (I assume that even with running ssh on a non-standard port, you're not changing the value in /etc/services, and you probably shouldn't do that anyway.)

  • that seems to have solved it, at least for now i cant find any new attempts in the auth file, thank you – Chris Jan 22 '16 at 17:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.