Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm working on a unix server, sshing into the machine using plink or session.net (a C# module that opens an ssh connection to the server and runs commands).

Everything was fine until we restarted the machine on Monday. Now whenever I attempt to access the machine with the program it does something like bans my ip address.

I've tried vi /etc/hosts.deny but there isn't anything there, and I only have read access to it and hosts.allow. I don't know much about unix system administration but I do need this computer to stop banning my ipaddress. (The username and passwords I'm using are correct, because when I use putty and winscp the server doesn't automatically ban my IP at first.)

Thanks for the help.

Edits:

  • I found /sbin/iptables but it says is not allowed to execute /sbin/iptables -L -v as root on pc

  • My boss ran iptables -L -v as root and there wasn't any information on the bans there

  • I found that after a certain amount of time--about an hour--the ban or block on my ip address is released, but it is quickly reestablished when I plink into the machine

  • rsa encryption and automatic login doesn't solve the problem

  • Rebooting the machine does cause it to allow 1 to 4 plinks then it refuses all new connections from an ip address

$ cat /etc/*release
20110420_1358
CentOS release 5.5 (Final)

$ cat /etc/hosts.deny

hosts.deny    This file describes the names of the hosts which are
              *not* allowed to use the local INET services, as decided
              by the '/usr/sbin/tcpd' server.

The portmap line is redundant, but it is left to remind you that
the new secure portmap uses hosts.deny and hosts.allow.  In particular
you should know that NFS uses portmap!

$ which denyhosts fail2ban
/usr/bin/which: no denyhosts in (/usr/kerberos/bin:/opt/454/bin:/usr/local/bin:/bin:/usr/bin:/home/adminrig/bin)
/usr/bin/which: no fail2ban in (/usr/kerberos/bin:/opt/454/bin:/usr/local/bin:/bin:/usr/bin:/home/adminrig/bin)

$ tail --lines=50 /var/log/auth.log /var/log/secure
tail: cannot open `/var/log/auth.log' for reading: No such file or directory
tail: cannot open `/var/log/secure' for reading: Permission denied
share|improve this question
1  
You should be talking to whoever manages / configured the box. Most likely it's running fail2ban and the password on the account / ssh key you are using has been changed. –  symcbean Apr 26 '12 at 15:53
    
How is the ban happening? If it keeps getting banned, I guess you have figured out how to unban it somehow? –  Zoredache Apr 26 '12 at 16:27
    
after i log in to the machine so many times it bans the computer...immediately if i use session.net. yes i do need to figure out how to unban it but i was hopeing someone from the community could provide some insight –  caseyr547 Apr 26 '12 at 16:41
    
It looks like fail2ban is running on the machine. –  adamo Apr 26 '12 at 16:47
    
@adamo if it is fail2ban where would it be? –  caseyr547 Apr 26 '12 at 16:53
show 5 more comments

2 Answers

up vote 1 down vote accepted

there was a rule in iptables similar to this one that caused it not to work:

iptables  -I INPUT -p TCP --dport 22 -m state --state NEW -m limit --limit 4/minute --limit-burst 5 -j ACCEPT
share|improve this answer
add comment

If the error message is something like;

Received disconnect from 123.123.123.123: 2: Too many authentication failures for userXXX

Then its not actually banned you, its just that you have tried to use multiple ssh keys, that you are not forcing password authentication in the script using some options like ssh -o PubkeyAuthentication=no username@hostname.com

share|improve this answer
    
when i try to plink into the server it says FATAL ERROR: Network eorror: Connection timed out but when i ping the computer it responds and when i change my ip it works correctly for a period of time then it rejects any other connections –  caseyr547 Apr 26 '12 at 17:12
    
i'm using plink -p 22 -ssh ip.adr.ess -l username -pw password –  caseyr547 Apr 26 '12 at 17:12
1  
In order make any progress you are going to need to provide some more information such as the output of some of these commands and paste the output verbatim into your question, for example cat /etc/*release then iptables --list -v -n and cat /etc/hosts.deny and which denyhosts fail2ban and tail --lines=50 /var/log/auth.log /var/log/secure –  Tom H Apr 26 '12 at 17:23
    
actually dont paste them verbatim, make sure you obscure your usernames and IP addresses first. –  Tom H Apr 26 '12 at 17:24
    
thank you tom i'll get on that list right now :) and i'll obscure stuff too –  caseyr547 Apr 26 '12 at 17:26
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.