-1

I set up a fail2ban system on my server to restrict SSH access. It works fine, except that after entering the username on the unit, if I enter the password incorrect 3 times (my maxretry value), it continues to allow the user to attempt to log in. But if I remove exit from trying to log in as that user, and open a new session, I am now banned.

When using putty, I enter the target address (but not it's username

login as: user
user@address's password: 1234
Access Denied
user@address's password: 1235
Access Denied
user@address's password: 1324
Access Denied
user@address's password: 1234
Access Denied
user@address's password: 1235
Access Denied
user@address's password: 1324
Access Denied

In theory it should not let me log in after the 3rd try, but instead it lets me go through 6 tries, after which I get a popup about having too many authentication failures. If I then go back, fail2ban has properly blocked the device from access.

How can I get it set up so that I am kicked off right after the 3rd try?

Edit: I am aware of this question. However, I believe this is different because the poster there asks why it is not blocking at all. I am more worried about why it does not block login attempts that are already in progress.

  • You probably need to have fail2ban in addition to adding a block run something to kill the state for any active connections. – thrig Sep 5 '17 at 21:59
  • @roaima it seems to be the same kind of question, but I don't see an answer there to "getting kicked off right after the 3rd try", in combination with thrig's comment about the active connection. – Jeff Schaller Sep 6 '17 at 0:25
  • @JeffSchaller ah ok. Re-re-reading – roaima Sep 6 '17 at 8:00
1

After some investigations on my side,

  • My iptables-based configuration of fail2ban does block active sessions, including those attempting to login and those already logged in.
  • My shorewall-based configuration of fail2ban does not block active sessions, but it does prevent new connection attempts.

The variation is down to the iptables rules used to ban traffic and the specific configuration of fail2ban.

Without knowing whether you're using raw iptables or one of the higher level abstractions (ufw, shorewall, etc.) here are some pointers:


Using iptables

  1. In jail.local I have the following definitions:

    banaction = iptables-multiport
    action_ = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s]
    action = %(action_)s
    

    Within each rule, either don't override the default, or else have banaction = iptables-multiport (which is the same as the default setting).

  2. Also in jail.local ensure the the maximum number of retries reflects your preferred policy, either as a default or per service ruleset:

    maxretries = 3
    
  3. In action.d/iptables-multiport.conf ensure you have definitions like this for the Ban and Unban rules:

    actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
    actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
    

Using Shorewall

If using the Shorewall connector for fail2ban you would need to adjust the default rules so that Shorewall did not apply the blocks just to initial sessions, but to all traffic for the IP address.

  1. In jail.local I have the following definitions:

    banaction = shorewall
    action_ = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s]
    action = %(action_)s
    

    Within each rule, either don't override the default, or else have banaction = shorewall (which is the same as the default setting).

  2. Also in jail.local ensure the the maximum number of retries reflects your preferred policy, either as a default or per service ruleset:

    maxretries = 3
    
  3. In the Shorewall configuration file shorewall.conf

    DYNAMIC_BLACKLIST=Yes
    BLACKLISTNEWONLY=No
    

    The BLACKLISTNEWONLY setting determines whether to block all connections or just new connections. You would want No here.

  • Interesting. I use ufw. Any clue about its settings? – user173724 Sep 6 '17 at 17:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.