SSH attack by IP that is blocked

Question

I run a CentOS 5.7 64bit server which has a strange issue.

While I was watching my logs at /var/log/secure I noticed that one strange IP was trying to connect to ssh with a lot of strange usernames.

Output of the log: http://pastebin.com/raw.php?i=3uYjPrLL

I run fail2ban which had already blocked this IP, and I also blocked this IP again manually via iptables.

Running iptables -n -L I got this output:

Chain fail2ban-SSH (1 references)
target     prot opt source               destination
DROP       all  --  50.115.166.129       0.0.0.0/0
RETURN     all  --  0.0.0.0/0            0.0.0.0/0

So the block is in place. Iptables is also running, and I have blocked many IP's via iptables already, and those blocks are all working fine.

But somehow this IP is able to get to my machine. Any idea how this is possible?

Answer 1

The issue is that your fail2ban-SSH chain is being applied to traffic to port 22, which isn't where your sshd is listening. So fail2ban picks up the failures from the auth logs, and correctly updates the refusal chain. But ssh traffic is never sent to that chain, so your malfeasor, who is now blocked from talking to port 22, is still able to talk to sshd on 2222.

Assuming you're using standard CentOS /etc/sysconfig/iptables, you need to change the line in the filter section that currently says something like

-A INPUT -p tcp --dport 22 -j fail2ban-SSH

to say

-A INPUT -p tcp --dport 2222 -j fail2ban-SSH

As for your manual drop, you have added it after the lines that say

 689M  126G ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED

and

 0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:2222 state NEW

so it will simply never get invoked to limit new traffic to port 2222, or subsequent packets in any such connection, as those have already been permitted. The order of rules is vital in iptables, because first dispositive match wins.