0

I have a Debian 10 server running on a VPS. The only software I installed are: tinyproxy (http proxy) and fail2ban

I have included:

  • the results of port scan using nmap
  • my specific settings in the fail2ban jail.local file.
  • my specific settings in the fail2ban fail2ban.local file.
  • a sample of entires from auth log.
  • a sample of entires from fail2ban log.
  • my results from sample scan of IpTables.

Problem Summary:

  • auth.log shows attempted entry by 192.241.141.43, almost every minute, all day long
  • fail2ban.log shows 192.241.141.43 is banned
  • Iptables shows 192.241.141.43 is banned

I thought that based upon the IP being blocked, that the malicious user would NOT be able to attempt a login. Yet it seems that the kernel is indeed (pam_unix(sshd:auth)) allowing attempted logins.

MY 2 QUESTIONS, Please:

  1. Why does the kernel allow malicious users to even attempt login if they are banned?
  2. Why does Iptables entry say "icmp" and not "tcp"? Yes I understand that a "ping" is an icmp packet, but I want to block tcp login attempts.

Many thanks !

Results from nmap scan

# Nmap 7.80 scan initiated Sat Jan 27 15:25:04 2024 as: nmap -sS -oG out.txt 

107.174.156.124

Host: 107.174.156.124 (107-174-156-124-host.colocrossing.com)   
Status: 
Up
Host: 107.174.156.124 (107-174-156-124-host.colocrossing.com)   
Ports: 
139/filtered/tcp//netbios-ssn///, 
445/filtered/tcp//microsoft-ds///, 
8888/open/tcp//sun-answerbook///    
Ignored State: closed (997)

# Nmap done at Sat Jan 27 15:25:06 2024 
-- 1 IP address (1 host up) scanned in 2.20 seconds

Here are my entries in jail.local

Please note that I have moved the SSHD port to 63xxx range. I have obscured the last 3 digits with xxx

#
# JAILS
#

#
# SSH servers
#

[sshd]

# To use more aggressive sshd modes set filter parameter "mode" in jail.local:
# normal (default), ddos, extra or aggressive (combines all).
# See "tests/files/logs/sshd" or "filter.d/sshd.conf" for usage example and details.
#mode   = normal
enabled = true
mode = aggressive
port = 63xxx
filter = sshd
logpath = /var/log/auth.log
bantime = 2000000
findtime = 7200
maxretry = 2
backend = %(sshd_backend)s
action = iptables-multiport[name=sshd, port="ssh", protocol=tcp]

fail2ban.local

# Options: dbpurgeage
# Notes.: Sets age at which bans should be purged from the database
# Values: [ SECONDS ] Default: 86400 (24hours)
dbpurgeage = 2100000

Sample Auth log

As example, there are several attempts by 192.241.141.43 And this is repeated almost every minute !

Jan 27 15:54:55 racknerd-64d010 sshd[2232]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.241.141.43  user=root
Jan 27 15:54:57 racknerd-64d010 sshd[2232]: Failed password for root from 192.241.141.43 port 54798 ssh2
Jan 27 15:54:57 racknerd-64d010 sshd[2232]: Received disconnect from 192.241.141.43 port 54798:11: Bye Bye [preauth]
Jan 27 15:54:57 racknerd-64d010 sshd[2232]: Disconnected from authenticating user root 192.241.141.43 port 54798 [preauth]

Sample of fail2ban

As example, fail2ban says 192.241.141.43 is banned

2024-01-27 15:55:50,928 fail2ban.actions        [29992]: WARNING [sshd] 82.102.12.130 already banned
2024-01-27 15:55:50,929 fail2ban.actions        [29992]: WARNING [sshd] 192.241.141.43 already banned
2024-01-27 15:55:50,929 fail2ban.actions        [29992]: WARNING [sshd] 159.75.161.40 already banned

Results from Iptables scan

IP 192.241.141.43 is banned

    0     0 REJECT     all  --  *      *       61.231.64.170        0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  *      *       192.241.141.43       0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  *      *       104.250.34.177       0.0.0.0/0            reject-with icmp-port-unreachable

Additional Info 1+2, Complete Rule Set

Here is a link to the complete ruleset file.

=== Additional Info Summary

I am including a summary here that incorporates the critical input from Chris Davies. I am doing this so that folks who are reading this in the future, will know, clearly, what to add in their SSHD Jail section of their jail.local file.

I am also including the single changed line of text from the fail2ban.local file - again, thanks Chris.

=== Here is jail.local

#
# JAILS
#

#
# SSH servers
#

[sshd]

# To use more aggressive sshd modes set filter parameter "mode" in jail.local:
# normal (default), ddos, extra or aggressive (combines all).
# See "tests/files/logs/sshd" or "filter.d/sshd.conf" for usage example and details.
#mode   = normal
enabled = true
mode = aggressive
port = 22
filter = sshd
logpath = /var/log/auth.log
bantime = 2000000
findtime = 7200
maxretry = 2
backend = %(sshd_backend)s
banaction_allports = iptables-allports
action_ap = %(banaction_allports)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
action = %(action_ap)s

=== Here is fail2ban.local

# Options: dbpurgeage
# Notes.: Sets age at which bans should be purged from the database
# Values: [ SECONDS ] Default: 86400 (24hours)
dbpurgeage = 2100000
7
  • Can't know what is happening without the whole ruleset: iptables-save -c.
    – A.B
    Commented Jan 28 at 16:02
  • Thank you AB. The result of the command you gave me above is a 3,000 line (232 kByte) file. How is an acceptable way to make this available? I'm pretty sure you dont want me to add 3,000 line of text to my post. Thank you for assisting.
    – xstack
    Commented Jan 28 at 16:29
  • OK I figured a solution. I edited my post to include link to the ruleset file.
    – xstack
    Commented Jan 28 at 16:44
  • You said you changed the SSH port to "the 63XXX range", but your firewall seems to only be concerned with connections destined for port 22. Your posted firewall does not seem to be blocking anything coming in from any port in the 63XXX range. Commented Jan 28 at 18:01
  • Thank you GracefulRestart. Please explain more. My jail.local file shows the port as 63xxx (this is just an obscuration of the last 3 digits). What do I do to correct the problem you have noted? Thank you.
    – xstack
    Commented Jan 28 at 18:15

1 Answer 1

1

The answer is very similar to the one I gave you the other day.

In this case you are only blocking the ssh port instead of the custom inbound port you're using for thr ssh service:

action = iptables-multiport[name=sshd, port="ssh", protocol=tcp]

Personally I'd recommend you simply block all connection requests from the offending IP address. Do this by using the following definitions in your jail.local - or the equivalent ones in your version of fail2ban:

banaction_allports = iptables-allports
action_ap = %(banaction_allports)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
action = %(action_ap)s

There's a hierarchy of definitions going on here. The action verb is the default for each [jail-name] section. I've changed it from action = %(action_)s, which if you look further up jail.conf you'll see is defined as action_ = %(banaction)s[port="%(port)s", protocol="%(protocol)s". This in turn uses the definition of banaction, defined to use iptables-multiport. Alongside that is a definition for banaction_allports = iptables-allports, so I just worked back down that set of definitions to arrive at action_ap. The iptables-allports can be found under action.d/


For Debian 10 (buster) you just need this setting to change the ban action from iptables-multiport to iptables-allports:

banaction = iptables-allports

as you should already have these:

action_ = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
action = %(action_)s
8
  • Hi Chris. Thank you for posting. Sorry I am so ignorant. [1] If I go to the the page from the other day and search for the string "action =", it is not found. [2] I dont know if the "action" statement above is one you are telling me that I set unknowingly, or you are telling me to set it that way. I WOULD INDEED like to block all connection requests from offending IPs. They are trying many different ports. If you would be so kind, how do I block all connection requests? PS I am considering moving back to Port 22 for SSH.
    – xstack
    Commented Jan 29 at 0:16
  • Hi again Chris. I now see where you got the "action =" statement from my jail specification. Is there a magic symbol to place in their like "*" that disallows log in on any port?
    – xstack
    Commented Jan 29 at 0:23
  • Hi Chris. I am thanking you again ! Honestly I am hopelessly lost. [1] You say "choose default action", then you say "to change". Sounds like NOT to use default action. [2] I am a scientist of 54 years and have no idea how the word "interpolation" makes any sense here. [3] You seem to be saying to use "action = %(action_ap)s" but the keyword "action_ap" does not appear anywhere in jail.local or fail2ban.local. I will keep banging my head on this. Again, thank you.
    – xstack
    Commented Jan 29 at 16:19
  • Hi Chris. I have downloaded the entire hierarchy of /etc/fail2ban and searched every file for "action_ap". No find. I have used search engines to look for fail2ban action_ap. No results. Don't know what to do next. NOTE: I much prefer putting all settings in the specific jail rather than inheriting from :Default" or other files.
    – xstack
    Commented Jan 29 at 16:45
  • @xstack what Linux distribution (and version) or UNIX system are you using? Commented Jan 29 at 22:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .