I have my ssh port changed to XXX. Then I did

ufw limit XXX/tcp

However, when I try to login, after 5/6 failed attempts I get thrown back to prompt, but I can try again. Is that supposed to be the way it works?

  • The example in the man page is ufw limit ssh/tcp – jasonwryan Dec 29 '11 at 3:17
  • @jasonwryan, it says it will deny IP who tried connecting >6 times in the last 30sec. But I can keep trying? – Jiew Meng Dec 29 '11 at 6:53
  • Did you try with ssh/tcp? Is ufw running? – jasonwryan Dec 29 '11 at 8:04
  • @jasonwryan, But I changed the port to XXX (a number of course, just dont think I should declare what port I use here :)). So I think I should be using LIMIT XXX/tcp instead of LIMIT ssh/tcp? – Jiew Meng Dec 29 '11 at 9:13
  • Yes: I read your question. My reading of the man page is that it limits the service irrespective of the port that it listens on. It can't hurt to try it, can it? – jasonwryan Dec 29 '11 at 9:51

If I understand your description correctly, you're typing ssh myserver.example.com and making a few failed attempts, and getting your local prompt back. That is still one TCP connection, so it counts for one against ufw limit (the firewall doesn't know anything about authentication attempts, it works at a lower level). You need to make 6 separate ssh connections within 30 seconds to trigger the limit.

  • Oh I got it now. Is it possible to limit the user to try 3 times (not the TCP connections). Perhaps I need denyhosts for that? Is there an alternative (just for my information) – Jiew Meng Dec 30 '11 at 3:28
  • 2
    @jiewmeng The number of permitted authentication failures in one SSH connection has to be managed by the SSH daemon, it can't be managed at the TCP level. Set MaxAuthTries in sshd_config. – Gilles Dec 30 '11 at 16:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.