Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I created a passwordless ssh login for one of my servers by using the authorized_keys file.

The server has fail2ban on it, and I noticed that after several successful logins I could no longer log in (connection timeout.) If I disable fail2ban, I can once again log in. Is there a way to configure fail2ban to not count my successful logins against me?

Thanks!

share|improve this question
    
Check your fail2ban log file to see why it's banning you, it should say which rule you triggered... Then check that rule and fix it as needed. It obviously shouldn't be banning successful logins. –  Chris S Mar 17 '11 at 1:28
add comment

3 Answers 3

up vote 2 down vote accepted

I had a similar situation. Even when a successful login takes place, a 'Failed' message appears in the sshd log file (/var/log/messages) It is caused by this regular expression (see Chris S answer):

^%(__prefix_line)sFailed [-/\w]+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$

matching lines like this from the /var/log/messages file:

Apr 18 14:07:02 hostname sshd[20972]: Failed none for root from 123.45.67.89 port 
50472 ssh2

When a user logs in successfully a 'Failed none' message still appears in the messages file.

To resolve this I changed the sshd_config file (/etc/ssh/sshd_config) to specify

LogLevel INFO

rather than

LogLevel VERBOSE

This stops the 'Failed none' message for successful logins, but retains it for login failures.

I also considered updating the sshd.conf fail2ban configuration file and adding something to the 'ignoreregex' line, but updating sshd is a cleaner solution.

share|improve this answer
add comment

You can use the ignoreip config option to tell fail2ban to ignore your IP.

http://www.fail2ban.org/wiki/index.php/Commands

Into /etc/fail2ban/jail.conf add something like

ignoreip = 127.0.0.1 192.168.0.0/24
share|improve this answer
3  
Wouldn't this be circumventing the problem rather than fixing it? –  Xeross Mar 17 '11 at 1:31
add comment

My sshd.local file has this line to fix a similar problem. Compare yours, it should be similar:

failregex = ^%(__prefix_line)s(?:error: PAM: )?[A|a]uthentication (?:failure|error) for .* from <HOST>\s*$
            ^%(__prefix_line)sDid not receive identification string from <HOST>$
            ^%(__prefix_line)sFailed [-/\w]+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
            ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$
            ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$
            ^%(__prefix_line)sUser \S+ from <HOST> not allowed because not listed in AllowUsers$
            ^%(__prefix_line)sauthentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
            ^%(__prefix_line)srefused connect from \S+ \(<HOST>\)$
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.