Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I created a passwordless ssh login for one of my servers by using the authorized_keys file.

The server has fail2ban on it, and I noticed that after several successful logins I could no longer log in (connection timeout.) If I disable fail2ban, I can once again log in. Is there a way to configure fail2ban to not count my successful logins against me?

Thanks!

share|improve this question
    
Check your fail2ban log file to see why it's banning you, it should say which rule you triggered... Then check that rule and fix it as needed. It obviously shouldn't be banning successful logins. – Chris S Mar 17 '11 at 1:28
up vote 4 down vote accepted

I had a similar situation. Even when a successful login takes place, a 'Failed' message appears in the sshd log file (/var/log/messages) It is caused by this regular expression (see Chris S answer):

^%(__prefix_line)sFailed [-/\w]+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$

matching lines like this from the /var/log/messages file:

Apr 18 14:07:02 hostname sshd[20972]: Failed none for root from 123.45.67.89 port 
50472 ssh2

When a user logs in successfully a 'Failed none' message still appears in the messages file.

To resolve this I changed the sshd_config file (/etc/ssh/sshd_config) to specify

LogLevel INFO

rather than

LogLevel VERBOSE

This stops the 'Failed none' message for successful logins, but retains it for login failures.

I also considered updating the sshd.conf fail2ban configuration file and adding something to the 'ignoreregex' line, but updating sshd is a cleaner solution.

share|improve this answer

You can use the ignoreip config option to tell fail2ban to ignore your IP.

http://www.fail2ban.org/wiki/index.php/Commands

Into /etc/fail2ban/jail.conf add something like

ignoreip = 127.0.0.1 192.168.0.0/24
share|improve this answer
3  
Wouldn't this be circumventing the problem rather than fixing it? – Not Available Mar 17 '11 at 1:31

My sshd.local file has this line to fix a similar problem. Compare yours, it should be similar:

failregex = ^%(__prefix_line)s(?:error: PAM: )?[A|a]uthentication (?:failure|error) for .* from <HOST>\s*$
            ^%(__prefix_line)sDid not receive identification string from <HOST>$
            ^%(__prefix_line)sFailed [-/\w]+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
            ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$
            ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$
            ^%(__prefix_line)sUser \S+ from <HOST> not allowed because not listed in AllowUsers$
            ^%(__prefix_line)sauthentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
            ^%(__prefix_line)srefused connect from \S+ \(<HOST>\)$
share|improve this answer

This is not solving your issue but hopefully giving you an idea why it happens.

The ssh client is using ssh keys as you described. I assume your client has more then one ssh key in the ssh agent listed (ssh-add -l). In such a setup, the ssh client is connecting to the server and tries to authenticate usin "one of the keys".

So what happens is that the ssh client tries one key after the other until one is accepted by the server.

Assuming 3 ssh keys, the worst case would result in 2 failed attempts followed by a successful login. Connecting multiple times with the "findtime" of fail2ban ... And you are banned.

I am currently looking for a solution as well. When I found it, i will share it. ;)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.