Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 2 down vote favorite
2

I currently block all ssh logins using root. But I wanted to go the extra mile and block the ip address of the client who tried to login as root. I currently have denyhosts and fail2ban setup and working, can I use denyhosts and or fail2ban to block the ip addresses of those who try to login as root?

share|improve this question

2 Answers

up vote 2 down vote accepted

Depending on your distribution, edit /etc/fail2ban/jail.conf Update the [ssh] section to show something like this

[ssh]

enabled = true
port    = ssh
filter  = sshd
logpath  = /var/log/auth.log
bantime = 3600
maxretry = 3

Change the parameters as required. It won't specifically block root, but every attempt that fails. Be careful with maxretry and the bantime. If you fail with your own password, while maxtretry set to low, you block yourself for the bantime. Restart fail2ban.

I wouldn't try to block the IP forever as a lot of attempts come from dynamic IPs which could block some legitim users at a later point of time.

(Some distributions offer a jail.options file for your modifications. This is the preferred place to put your changes to as it shouldn't be affected by updates overwriting the conf.)

share|improve this answer
good info, but i think he wanted to know how to block all logins using user root... can't see that in your answer. maybe you forgot that. – Mose Dec 14 '11 at 14:47
up vote 0 down vote

How did you block ssh logins? /bin/false or the sshd_config DenyUsers option?

I can't think of an answer out of my head, but IIRC denyhosts parses the log file, so just see if you get a failed entry in the log file after some one tries to log in to root with it disabled

share|improve this answer
2  
I edited the ssh config file, /etc/ssh/sshd_config, and changed PermitRootLogin from yes to no. I don't know if this is relevant, but I do have rssh installed to only allow certain users to login using sftp but not allow ssh. – chudapati09 Dec 13 '11 at 18:38
did you check the ssh log files if it has the failed user log in attempt? – MitziMeow Dec 13 '11 at 19:47
Yes, I can see that there are many failed user login attempts by many different ip addresses, which I don't recognize. – chudapati09 Dec 13 '11 at 19:50
then denyhosts should work – MitziMeow Dec 14 '11 at 6:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.