1

I use the default fail2ban configuration for ssh connection attempts on my Debian server hosting my web and mail servers.

I already switched away from the default ssh port and things were quite for a long time. It seam that my server got caught in the radar of some hacker in control of a bot network. I’m suddenly harassed by hundreds connection attempts for some days now on this secondary port.

Most of these connection attempts try invalid user names. There is no chance they get in with these, but I would prefer to keep them away.

I can’t install port knocking since I use ansible to automatically configure the server. I don’t know how to combine the two.

An intermediate solution would be to make fail2ban more penalizing with ssh connection attempts using a bad user name. Since I use ssh/config I never make a mistake with my user name and I can always connect with my phone if needed where the user name is also registered. That would be nice for dovecot as well.

Is it possible to configure fail2ban to jail an IP for a very long time if the connection failed because the user name was invalid ?

I’m running Debian 10 (Buster). Fail2ban is version 0.10.2. Ssh is version 7.9p1.

3

Just change the bantime to whatever time period you want, or -1 to ban forever.

bantime is expressed as a number of seconds, or -1. Recent versions (I think 0.9.x or later) accept suffixes for longer time periods, such as minute, hour, day, or week.

2
  • I know I can change the ban duration. What I asked is if it’s possible to ban for a longer duration if the user name is invalid. This is because I may make a mistake by typing the password, but never with the user name. Especially if the login name of the connection attempt is root, I want to ban for a very long time. – chmike Mar 15 at 8:34
  • I finally applied your solution which is the best we can do for now. I'll see how it evolves – chmike Mar 16 at 12:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.