3

I have locked the root account on my server with passwd -l root and so an attempted login results in the following in /var/log/auth.log:

User root not allowed because account is locked

Fail2Ban does not pick these up and so the attempts continue for extended periods. How can I adjust Fail2Ban to recognise these?

Full message example:

Apr 10 13:32:28 server sshd[pid]: User root not allowed because account is locked
2
  • Is that the full message? If not can you supply an example of the full message. Without a <HOST> block there is little fail2ban can do.
    – user9517
    Apr 10, 2013 at 13:16
  • Generally, you get 3 different messages, none of which seem to cause fail2ban to ban the IP: Jan 11 11:19:54 <hostname> sshd[19285]: User root not allowed because account is locked Jan 11 11:19:54 <hostname> sshd[19285]: Received disconnect from 61.184.247.3 port 39292:11: [preauth] Jan 11 11:19:54 <hostname> sshd[19285]: Disconnected from invalid user root 61.184.247.3 port 39292 [preauth]
    – slacy
    Jan 11, 2019 at 19:21

2 Answers 2

1

So you are trying to block all IPs that try to login as root? I would imagine most non-targeted hacking attempts will first try logging in as root then try enough non-existent accounts to get the IP banned.

If this isn't the case maybe you should change your approach.

I think a better option than locking root altogether would be to disable external login as root through sshd's config. That may result in attempts to login as root triggering a security message that fail2ban can use.

0

Fail2ban will not be able to work with the information provided as there is no <HOST> information for it to block.

<HOST> information is an IP Address or hostname from which the attack takes place, fail2ban uses this information to update the firewall configuration, without it there is nothing to do.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .