2

I have my ssh port changed to XXX. Then I did

ufw limit XXX/tcp

However, when I try to login, after 5/6 failed attempts I get thrown back to prompt, but I can try again. Is that supposed to be the way it works?

7
  • The example in the man page is ufw limit ssh/tcp
    – jasonwryan
    Dec 29, 2011 at 3:17
  • @jasonwryan, it says it will deny IP who tried connecting >6 times in the last 30sec. But I can keep trying?
    – Jiew Meng
    Dec 29, 2011 at 6:53
  • Did you try with ssh/tcp? Is ufw running?
    – jasonwryan
    Dec 29, 2011 at 8:04
  • @jasonwryan, But I changed the port to XXX (a number of course, just dont think I should declare what port I use here :)). So I think I should be using LIMIT XXX/tcp instead of LIMIT ssh/tcp?
    – Jiew Meng
    Dec 29, 2011 at 9:13
  • Yes: I read your question. My reading of the man page is that it limits the service irrespective of the port that it listens on. It can't hurt to try it, can it?
    – jasonwryan
    Dec 29, 2011 at 9:51

1 Answer 1

2

If I understand your description correctly, you're typing ssh myserver.example.com and making a few failed attempts, and getting your local prompt back. That is still one TCP connection, so it counts for one against ufw limit (the firewall doesn't know anything about authentication attempts, it works at a lower level). You need to make 6 separate ssh connections within 30 seconds to trigger the limit.

2
  • Oh I got it now. Is it possible to limit the user to try 3 times (not the TCP connections). Perhaps I need denyhosts for that? Is there an alternative (just for my information)
    – Jiew Meng
    Dec 30, 2011 at 3:28
  • 2
    @jiewmeng The number of permitted authentication failures in one SSH connection has to be managed by the SSH daemon, it can't be managed at the TCP level. Set MaxAuthTries in sshd_config. Dec 30, 2011 at 16:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .