1

I tried to install Fail2ban on my Centos 7 machine to prevent force brute connection on ssh server.

I'm using a private key with a passphrase to connect. I tested Fail2ban but it doesn't block me when i put a bad passphrase.

I just want to insist that i'm usinfg my private key to connect to ssh.

Thanks for help :)

Improve this question

1 Answer 1

Reset to default
1

The passphrase is used on your local machine to unlock your private key, before using it to encrypt the challenge which is then sent to the remote machine to be checked against the public key stored in the authorised_keys file.

If you enter the wrong passphrase then no challenge will be sent to the remote machine so there won't be a failed attempt for fail2ban to match against (at least not with the default rules).

You can enforce private key only authentication in the ssh server configuration.

Improve this answer
2
  • Ok, the server cannot know if the passphrase is wrong since it is resolved on the client but there is still a question not answered: is it possible to block SSH failed key-based login with fail2ban? For example if the public / private key used on the client does not match the public key used on the server?
    – baptx
    Mar 14, 2020 at 19:19
  • That is a totally separate question to what the OP asked, ask a new question and reference this one if needed.
    – hardillb
    Mar 14, 2020 at 19:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .