I'm working on a unix server, sshing into the machine using plink or session.net (a C# module that opens an ssh connection to the server and runs commands).

Everything was fine until we restarted the machine on Monday. Now whenever I attempt to access the machine with the program it does something like bans my ip address.

I've tried vi /etc/hosts.deny but there isn't anything there, and I only have read access to it and hosts.allow. I don't know much about unix system administration but I do need this computer to stop banning my ipaddress. (The username and passwords I'm using are correct, because when I use putty and winscp the server doesn't automatically ban my IP at first.)

Thanks for the help.


  • I found /sbin/iptables but it says is not allowed to execute /sbin/iptables -L -v as root on pc

  • My boss ran iptables -L -v as root and there wasn't any information on the bans there

  • I found that after a certain amount of time--about an hour--the ban or block on my ip address is released, but it is quickly reestablished when I plink into the machine

  • rsa encryption and automatic login doesn't solve the problem

  • Rebooting the machine does cause it to allow 1 to 4 plinks then it refuses all new connections from an ip address

$ cat /etc/*release
CentOS release 5.5 (Final)

$ cat /etc/hosts.deny

hosts.deny    This file describes the names of the hosts which are
              *not* allowed to use the local INET services, as decided
              by the '/usr/sbin/tcpd' server.

The portmap line is redundant, but it is left to remind you that
the new secure portmap uses hosts.deny and hosts.allow.  In particular
you should know that NFS uses portmap!

$ which denyhosts fail2ban
/usr/bin/which: no denyhosts in (/usr/kerberos/bin:/opt/454/bin:/usr/local/bin:/bin:/usr/bin:/home/adminrig/bin)
/usr/bin/which: no fail2ban in (/usr/kerberos/bin:/opt/454/bin:/usr/local/bin:/bin:/usr/bin:/home/adminrig/bin)

$ tail --lines=50 /var/log/auth.log /var/log/secure
tail: cannot open `/var/log/auth.log' for reading: No such file or directory
tail: cannot open `/var/log/secure' for reading: Permission denied
  • 1
    You should be talking to whoever manages / configured the box. Most likely it's running fail2ban and the password on the account / ssh key you are using has been changed. – symcbean Apr 26 '12 at 15:53
  • How is the ban happening? If it keeps getting banned, I guess you have figured out how to unban it somehow? – Zoredache Apr 26 '12 at 16:27
  • after i log in to the machine so many times it bans the computer...immediately if i use session.net. yes i do need to figure out how to unban it but i was hopeing someone from the community could provide some insight – user118873 Apr 26 '12 at 16:41
  • It looks like fail2ban is running on the machine. – adamo Apr 26 '12 at 16:47
  • @adamo if it is fail2ban where would it be? – user118873 Apr 26 '12 at 16:53

there was a rule in iptables similar to this one that caused it not to work:

iptables  -I INPUT -p TCP --dport 22 -m state --state NEW -m limit --limit 4/minute --limit-burst 5 -j ACCEPT

If the error message is something like;

Received disconnect from 2: Too many authentication failures for userXXX

Then its not actually banned you, its just that you have tried to use multiple ssh keys, that you are not forcing password authentication in the script using some options like ssh -o PubkeyAuthentication=no username@hostname.com

  • when i try to plink into the server it says FATAL ERROR: Network eorror: Connection timed out but when i ping the computer it responds and when i change my ip it works correctly for a period of time then it rejects any other connections – user118873 Apr 26 '12 at 17:12
  • i'm using plink -p 22 -ssh ip.adr.ess -l username -pw password – user118873 Apr 26 '12 at 17:12
  • 1
    In order make any progress you are going to need to provide some more information such as the output of some of these commands and paste the output verbatim into your question, for example cat /etc/*release then iptables --list -v -n and cat /etc/hosts.deny and which denyhosts fail2ban and tail --lines=50 /var/log/auth.log /var/log/secure – Tom H Apr 26 '12 at 17:23
  • actually dont paste them verbatim, make sure you obscure your usernames and IP addresses first. – Tom H Apr 26 '12 at 17:24
  • thank you tom i'll get on that list right now :) and i'll obscure stuff too – user118873 Apr 26 '12 at 17:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy