This is several days ago, I observed some IP addresses was't banned by fail2ban, and continued to brute force attack on different port of ssh. This an extract of my logwatch:

undef: 22 times
a [preauth]: 1 time
adm [preauth]: 1 time
admin [preauth]: 1 time
fakepass [preauth]: 1 time

I did a grep on the login of the attack in the "auth.log" file as the IP adresse doesn't appear in the logwatch, and I found this:

May  2 11:06:07 host sshd[16474]: Invalid user fakepass from                  
May  2 11:06:07 host sshd[16474]: input_userauth_request: invalid user fakepass [preauth]  
May  2 11:06:09 host sshd[16474]: Failed password for invalid user fakepass from port 5278 ssh2     

I noted the IP address wasn't banned, and the attack is not on the prot TCP 22 so it's continuing to try with other TCP port and login

Where's my miss configure. Thanks

  • 4
    It's going to be very difficult to spot your misconfiguration if you don't show your configuration in the first place. – garethTheRed May 4 '16 at 8:54
  • Would be interesting, but probably not probative, to know why you're running ssh on multiple ports at once as well. – EightBitTony May 4 '16 at 9:11
  • I kept 22 as SSH tcp port I went to extend the findtime in the jail.conf. Yuo can find it here: justpaste.it/txvz – dubis May 4 '16 at 12:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.