Home / server / Questions / 248376
Accepted
Tom
Asked: 2011-03-17 17:15:38 +0800 CST

fail2ban bans me after a series of *successful* logins

  • 772

I created a passwordless ssh login for one of my servers by using the authorized_keys file.

The server has fail2ban on it, and I noticed that after several successful logins I could no longer log in (connection timeout.) If I disable fail2ban, I can once again log in. Is there a way to configure fail2ban to not count my successful logins against me?

Thanks!

ssh fail2ban

4 Answers

  1. Best Answer

    I had a similar situation. Even when a successful login takes place, a 'Failed' message appears in the sshd log file (/var/log/messages) It is caused by this regular expression (see Chris S answer):

    ^%(__prefix_line)sFailed [-/\w]+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$

    matching lines like this from the /var/log/messages file:

    Apr 18 14:07:02 hostname sshd[20972]: Failed none for root from 123.45.67.89 port 
50472 ssh2

    When a user logs in successfully a 'Failed none' message still appears in the messages file.

    To resolve this I changed the sshd_config file (/etc/ssh/sshd_config) to specify

    LogLevel INFO

    rather than

    LogLevel VERBOSE

    This stops the 'Failed none' message for successful logins, but retains it for login failures.

    I also considered updating the sshd.conf fail2ban configuration file and adding something to the 'ignoreregex' line, but updating sshd is a cleaner solution.

    • 9

  2. You can use the ignoreip config option to tell fail2ban to ignore your IP.

    http://www.fail2ban.org/wiki/index.php/Commands

    Into /etc/fail2ban/jail.conf add something like

    ignoreip = 127.0.0.1 192.168.0.0/24
    • 3

  3. My sshd.local file has this line to fix a similar problem. Compare yours, it should be similar:

    failregex = ^%(__prefix_line)s(?:error: PAM: )?[A|a]uthentication (?:failure|error) for .* from <HOST>\s*$
            ^%(__prefix_line)sDid not receive identification string from <HOST>$
            ^%(__prefix_line)sFailed [-/\w]+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
            ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$
            ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$
            ^%(__prefix_line)sUser \S+ from <HOST> not allowed because not listed in AllowUsers$
            ^%(__prefix_line)sauthentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
            ^%(__prefix_line)srefused connect from \S+ \(<HOST>\)$
    • 2

  4. This is not solving your issue but hopefully giving you an idea why it happens.

    The ssh client is using ssh keys as you described. I assume your client has more then one ssh key in the ssh agent listed (ssh-add -l). In such a setup, the ssh client is connecting to the server and tries to authenticate usin "one of the keys".

    So what happens is that the ssh client tries one key after the other until one is accepted by the server.

    Assuming 3 ssh keys, the worst case would result in 2 failed attempts followed by a successful login. Connecting multiple times with the "findtime" of fail2ban ... And you are banned.

    I am currently looking for a solution as well. When I found it, i will share it. ;)

    • 1