Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an ubuntu 11.10 VM running on an OSX machine.

Every once in a while some services become inaccessible from specific IPs (e.g. sometimes just ssh is blocked, and sometimes both ssh and https.)

The blocking of e.g. the ssh isn't per user, since the same blocked user can change his IP and immediately connect successfully that way.

I'm not aware of any special security software that was installed on either the ubuntu nor OSX. Specifically, there's no fail2ban on either of them.

How would I go about investigating which process exactly is responsible for this? Also, how can I try to eliminate the possibility that it's the router which is causing this?

share|improve this question
    
Did you check logs on the Ubuntu VM to see if anything shows up pertaining to the services in question? –  Bart Silverstrim May 29 '12 at 12:18

1 Answer 1

Is connection refused, or do you get a timeout?

can you tcpdump the failed connection from both sides to see if any packets come back from, or make it through the the remote network at all?

If you run a tcpdump on the remote side, and it never sees any of the "banned connections" traffic on its interface, then typically you are dealing with some network level IPS, or other peculiarity, which is totally removed from the OS or configuration on the server side.

(so you would need to get an network administrator involved)

share|improve this answer
    
the connection attempt times out –  GJ. May 29 '12 at 15:09
    
during the connection failed events, run something like this on the server tcpdump -q -s0 port 22 and host 123.123.123.123 where 123.123.123.123 is your client that is being refused. This will tell you if any traffic makes it to the server, or is being dropped on the network. –  Tom H May 29 '12 at 15:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.