Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

after several intentional unsuccessful login attempts fail2ban has banned me from my server but I am still able to log in afterwards.

# iptables -L  
Chain INPUT (policy ACCEPT)
target prot opt source destination
fail2ban-ssh tcp -- anywhere anywhere multiport dports ssh

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain fail2ban-ssh (1 references)
target prot opt source destination
DROP all -- dslb-xx-xx-xx-xx.pools.arcor-ip.net anywhere
RETURN all -- anywhere anywhere 



cat /var/log/fail2ban.log  
Ban xx.xx.xx.xx  
xx.xx.xx.xx already banned


ssh user@yy.yy.yy.yy -p yyyyy  
user's password:************  
Linux hostname 2.6.26-2-amd64  
user@hostname:~$

So fail2ban tells me I am banned but I can still log in.
Any hints?

Here is the whole output of "iptables -L"

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
fail2ban-ssh  tcp  --  anywhere anywhere        multiport dports ssh  

Chain FORWARD (policy ACCEPT)  
target     prot opt source               destination    
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
Chain fail2ban-ssh (1 references)  
target     prot opt source               destination
DROP       all  --  dslb-xx-xx-xx-xx.pools.arcor-ip.net  anywhere  
RETURN     all  --  anywhere             anywhere
share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

In the file /fail2ban/jail.conf edit the following :

[ssh]

enabled  = true
filter   = sshd
action   = iptables[name=SSH, port="yyyy,ssh", protocol=tcp]
logpath  = /var/log/sshd/current
maxretry = 3

I've seen you were using an alternative port for ssh so, replace the yyyy be the port the sshd deamon is running.

Then restart fail2ban.

share|improve this answer
    
please note that fail2ban is really useful if you need to keep 22 as ssh port. If you use an high random port, it's very hard for drones to find it. –  user29686 Jul 28 '10 at 21:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.