1

We just started using google cloud compute engine, and to connect to the server using sftp a couple of colleagues did a number of failed login attempts. Now we cannot access our google cloud engine vm instance from our office anymore, on any port directly from our IP. From any other location (IP address) we can access. First we thought it might be a temp block, but it has been a week now so it seems to be rather permanent.

  • I have just attempted to reproduce your problem, and after hundreds of failed login attempts I am still not being blocked. Some additional information could be useful: 1. Which install image did you use? 2. Did you install any additional software such as fail2ban? 3. Have you inspected network traffic on your VM to see if the blocking is done by your VM or somewhere else? Disclaimer: I work for Google but any views I express on this site are my own. – kasperd Aug 30 '16 at 20:29
2

Joinning the party years later, but someone could benefit from this.

Looks like every ubuntu image has sshguard installed, after a few failed SSH login attempts your IP gets banned/blocked.

You need to connect to your instance from another ip, or use the ssh connection inside web-console from google compute engine.

What you can do is check if your ip has been banned:

sudo iptables --list sshguard --line-numbers --numeric | grep [you.ip.goes.here]

On the output you will have a line with a number at the beginning, that line must be removed (replace [N] with that line number):

sudo iptables --delete sshguard [N]

Then you should be able to connect to your server again.

There are people that suggest adding the ip to the sshguard white list and then restarting the sshguard service... I didn't try it because my i think my solution is safer given the fact that my ip can change. If you happen to need a fixed IP being white listed of solution, comment is here:

https://stackoverflow.com/questions/26813070/google-compute-engine-getting-blocked-after-accessing-ssh-a-few-times/26827428#comment84875330_26827428

Also some doc from sshguard where I got my final answer: https://wiki.archlinux.org/index.php/Sshguard#Unbanning

1

If the IP were blocked by Google, a notice would have been delivered to the account about the block. If a notice was not received, then the failure to connect is due to some other cause. The suggestions offered by kasperd are good, a likely candidate is some security monitor on the instance.

  • I m able to login to console, rdp, ftp, mssql except port 80. I have created 3 VM's from 3 different console accounts. It is same with all. – Ivan Lewis Sep 5 '16 at 7:25
  • This is happening my pc and for some people who are using same ISP. – Ivan Lewis Sep 5 '16 at 8:41
  • Ah, ISP is a good clue. They may be running a proxy that itself has some issues. May want to think about foregoing http on port 80. Try having the app listen on 443, and just hit that using http. – Jonah Benton Sep 5 '16 at 11:42
  • http on other ports it is working. I m asking my ISP as well but not able to figure out what is the problem that too with Google VMs. I have amazon EC2 instances which is working without any problems. – Ivan Lewis Sep 6 '16 at 5:52
  • This sounds like a very unusual issue. How does the failure manifest itself? Does telnet to the host on port 80 succeed? – Jonah Benton Sep 6 '16 at 13:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.