1

I just launched a website within my school community and woke up this morning to logs of someone trying to bruteforce into my server. I followed some guides on digitalocean to set up fail2ban and iptables, and am still able to ssh into the server using port 22.

However, I cannot seem to interact with the server over sftp. I have tried both winscp and filezilla and both seem to time out

For winscp I get this:

Host is not communicating for more than 15 seconds.
Authentication log (see session log for details):
Using username "will".

Authentication failed.

And with filezilla I get this:

Status: Resolving address of %website%
Status: Connecting to %ip%:21...
Error:  Connection timed out after 20 seconds of inactivity
Error:  Could not connect to server
Status: Waiting to retry...

Also, sudo iptables -S returns this:

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N fail2ban-apache
-N fail2ban-apache-noscript
-N fail2ban-apache-overflows
-N fail2ban-ssh
-A INPUT -p tcp -m multiport --dports 80,443 -j fail2ban-apache-overflows
-A INPUT -p tcp -m multiport --dports 80,443 -j fail2ban-apache
-A INPUT -p tcp -m multiport --dports 80,443 -j fail2ban-apache-noscript
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -j DROP
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A fail2ban-apache -j RETURN
-A fail2ban-apache-noscript -j RETURN
-A fail2ban-apache-overflows -j RETURN
-A fail2ban-ssh -j RETURN

Anyone have any idea? Thanks!

0

Do you have the Subsystem for sftp enabled in your /etc/ssh/sshd_config file? The line might look like this:

Subsystem       sftp    /usr/libexec/sftp-server  (or your location of executable)

On another server (Debian/Ubuntu Jessie):

Subsystem sftp /usr/lib/openssh/sftp-server

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.