0

I've got a new Ubuntu Server setup with OpenSSH access (on a custom port) and a Fail2Ban installation.

Fail2Ban seems to be correctly banning IPs and adding them to the iptables, however once banned I can still gain SSH access (from the banned IP, 131.111.96.100 in this case) with a valid account. IPtables are as below, any thoughts?

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
f2b-selinux-ssh  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 22
f2b-sshd-ddos  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 22
f2b-sshd   tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 22

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain f2b-selinux-ssh (1 references)
target     prot opt source               destination         
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           

Chain f2b-sshd (1 references)
target     prot opt source               destination         
REJECT     all  --  131.111.96.100       0.0.0.0/0            reject-with     icmp-port-unreachable
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           

Chain f2b-sshd-ddos (1 references)
target     prot opt source               destination         
REJECT     all  --  179.156.139.17       0.0.0.0/0            reject-with icmp-port-unreachable
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           
3

As I can see from your IPTables settings, fail2ban manage only IPTables for port 22. If you have SSH on different port, rules from fail2ban are not used. Change configuration of your failban to manage rules for proper ssh port.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.