2

this is the first time that i did not find a solution here.
so, hopefully it can be solved.

i've installed a fresh, new ubuntu minimal system (14.04) with ssh on it.
Right after that i installed fail2ban.
my ssh is running on port 47629

my jail.conf:

ignoreip = 127.0.0.1 10.14.11.165
bantime = 9999
findtime = 150
maxretry = 3
backend = auto
usedns = warn
destemail = [email protected]
sendername = [email protected]
mta = mail
chain = INPUT
action = %(action_mwl)s


[ssh-iptables]

enabled  = true
port     = 47629
filter   = sshd
action = iptables[name=SSH, port=47629, protocol=tcp]
sendmail-whois[name=SSH, [email protected], [email protected]]
logpath  = /var/log/auth.log
maxretry = 4

my auth.log looks like this

Jan 15 08:16:38 hostweb sshd[5841]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.14.11.57  user=root
Jan 15 08:16:40 hostweb sshd[5841]: Failed password for root from 10.14.11.57 port 50091 ssh2
Jan 15 08:17:02 hostweb CRON[5843]: pam_unix(cron:session): session opened for user root by (uid=0)
Jan 15 08:17:02 hostweb CRON[5843]: pam_unix(cron:session): session closed for user root
Jan 15 08:17:02 hostweb CRON[5843]: pam_unix(cron:session): session opened for user root by (uid=0)
Jan 15 08:17:02 hostweb CRON[5843]: pam_unix(cron:session): session closed for user root
Jan 15 08:17:37 hostweb sshd[5841]: message repeated 5 times: [ Failed password for root from 10.14.11.57 port 50091 ssh2]
Jan 15 08:17:37 hostweb sshd[5841]: Disconnecting: Too many authentication failures for root [preauth]
Jan 15 08:17:37 hostweb sshd[5841]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.14.11.57  user=root
Jan 15 08:17:37 hostweb sshd[5841]: PAM service(sshd) ignoring max retries; 6 > 3

even when i set maxretry = 1 it never works

i set in /etc/ssh/sshd_config

MaxAuthTries 8

hopefully fail2ban grabs the block first, with no success

tips how to solve this?

1
  • 1
    Might help to list the contents of your /etc/ssh/sshd_config and /var/log/fail2ban.log files. Maybe your sshd_config is missing the UsePAM yes line?
    – joe
    Jan 15, 2015 at 11:01

1 Answer 1

1

I followed this DigitalOcean guide and from what you've posted, you need to copy the jail.conf file to jail.local in order for it to work.

From the guide:

There is a file with defaults called jail.conf.

Since this file can be modified by package upgrades, we should not edit this file in-place, but rather copy it so that we can make our changes safely.

We need to copy this to a file called jail.local for fail2ban to find it:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .