Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have already blocked logging in as root with ssh, so I know that any attempt to do that is malicious. I know they wont succeed (sshd wont allow it), but I'd nevertheless would like to ban the IP in question immediately. How would I do that?

I'm running Gentoo Linux, and have fail2ban already running. I don't want to ban everyone for one failed logging attempt, so simply setting fail2ban attempt to 1 is not an option. Root is the only account I'd wish to apply this immediate ban.

share|improve this question
Why would you do this? If root can't login, there's no benefit from blocking IPs that try. – Alex Holst Jun 6 '12 at 18:57
@AlexHolst Those IPs are almost certainly part of Bot Nets, and though they may stop trying SSH, they might move on to a different attack vector. In any case once you've identified them, might as well perma-ban. – Chris S Jun 6 '12 at 18:59
up vote 4 down vote accepted

I setup two different Fail2Ban rules:

  1. If they try an invalid username they get banned on the first try, permanently. I don't have many people getting in that way and none of them have ever got banned that way; but it may be a support issue if you've got lots of people signing in. Root isn't a valid ssh login on my systems.

    I'm on a FreeBSD system, so you might have to modify this rule a touch. Create a ssh-invaliduser.local file in the filter.d directory:

    failregex = ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$

    Set the options for this rule as usual in the jail.local file.

  2. The second rule locks out attempts that have got the password wrong 10 times for 10 minutes. Nobody's going to break in at 1 password per minute average speed.

share|improve this answer
I actually feel a bit dumb for not coming up with this myself. Two sets of rules, of course. Thank you, Chris. – Vuoristoneuvos Jun 6 '12 at 20:52

If you are using the standard sshd log output and your system is running the tcp wrapper tcpd, try the following:

First add this line in /etc/hosts.deny:

sshd: /tmp/root_ban.list

Then schedule cron to run the following command:

awk '/invalid user root from/{print $13}' /var/log/ssh_auth.log | sort -u > /tmp/root_ban.list

If the output of the awk part of the command doesn't work, ajust the condition part: invalid user root from to match your sshd logs. You might also need to change the field number captured by awk. I my logs, the ip is in the 13th position ($13).

And, to avoid blocking you out, you can add trusted ip's in the /etc/hosts.allow file:

share|improve this answer
Setting up cron collection jobs when he's got Fail2Ban running seems awfully redundant. – Chris S Jun 6 '12 at 19:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.