0

I have an ubuntu 11.10 VM running on an OSX machine.

Every once in a while some services become inaccessible from specific IPs (e.g. sometimes just ssh is blocked, and sometimes both ssh and https.)

The blocking of e.g. the ssh isn't per user, since the same blocked user can change his IP and immediately connect successfully that way.

I'm not aware of any special security software that was installed on either the ubuntu nor OSX. Specifically, there's no fail2ban on either of them.

How would I go about investigating which process exactly is responsible for this? Also, how can I try to eliminate the possibility that it's the router which is causing this?

1
  • Did you check logs on the Ubuntu VM to see if anything shows up pertaining to the services in question? May 29, 2012 at 12:18

1 Answer 1

0

Is connection refused, or do you get a timeout?

can you tcpdump the failed connection from both sides to see if any packets come back from, or make it through the the remote network at all?

If you run a tcpdump on the remote side, and it never sees any of the "banned connections" traffic on its interface, then typically you are dealing with some network level IPS, or other peculiarity, which is totally removed from the OS or configuration on the server side.

(so you would need to get an network administrator involved)

2
  • the connection attempt times out
    – GJ.
    May 29, 2012 at 15:09
  • during the connection failed events, run something like this on the server tcpdump -q -s0 port 22 and host 123.123.123.123 where 123.123.123.123 is your client that is being refused. This will tell you if any traffic makes it to the server, or is being dropped on the network.
    – Tom
    May 29, 2012 at 15:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .