Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Is there a way to automatically block IP address when a user tries to login as any invalid username? I already have:

[ssh]

enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 3
bantime = 31536000

in /etc/fail2ban/jail.conf

share|improve this question

4 Answers 4

up vote 4 down vote accepted

I cannot help you with fail2ban, but I am using denyhosts quite successfully for exactly this thing. You can tune quite a lot parameters and it also have a distributed database where you can send and receive other badhosts.

Here's more detailed howto:

Install denyhosts package (sudo apt-get install denyhosts)

Look at the default configuration in /etc/denyhosts.conf, you might be interested in DENY_TRESHOLD_INVALID, DENY_TRESHOLD_VALID and DENY_TRESHOLD_ROOT options.

As for the sync server it's disabled by default and you will need to enable it by uncommenting SYNC_SERVER option.

It's also not bad to set PURGE_DENY option to 1w or something like that in case you block-out yourself, so the entry will get purge after one week and you will be able to login again.

share|improve this answer

Why not just deny all root logins entirely over SSH, rather than using Fail2Ban or other stuff? By doing that, and denying the use of the root login, you remove the issue of having to block everyone, because even if they guess the root password, it'll deny them login. Regardless of how many times they try.

In /etc/ssh/sshd_config, find the line containing PermitRootLogin. Edit that with whatever text editor, but make sure you use sudo/gksudo (gksudo only if you're using a GUI text editor). Make that line I mentioned say PermitRootLogin no, then save, and do sudo service ssh restart.

(This answer was written for the incorrectly-stated initial question. This answer will not be modified to match the revised question, because that's beyond my ability to answer. I may delete THIS answer in future)

share|improve this answer
    
I do have that setting enabled however what I'm attempting to do is remove all unnecessary traffic to the server. I'm attempting to have an IP address banned after 3 attempts from using a wrong username, including root. I have had attempts to login with usernames like harry potter, sally... etc. –  slayton1213 Mar 20 '13 at 19:35
    
@slayton1213 Based on your comment, I have revised your question and what it is asking, to be more specific to what your actual goal is. Please confirm I got that right. –  Thomas W. Mar 20 '13 at 19:41
    
yes this is correct. –  slayton1213 Mar 20 '13 at 19:41
    
OK, I can't answer THAT, i only answered the initial question, @slayton1213. I will probably delete this answer in the near future,as a result. –  Thomas W. Mar 20 '13 at 19:59

This is deliberately not supported in fail2ban:

In other words, invalid users may get 2 attempts while invalid password for valid users get 5 attempts. How can that be done in fail2ban?

A convincing argument against doing this says that it lets an attacker know whether or not a username is valid, and thus dramatically decreases the search space of a brute-force attack.

I found your question while trying to do the same thing, but now I've changed my mind. Apart from the secrecy benefit, why save an attacker time by cutting them off early?

share|improve this answer

Paste some lines of your /var/log/auth.log with some of these invalid usernames and we can give you a customized filter.

And my two cents:

  1. Try to use always jail.local as prays jail.conf header:

    To avoid merges during upgrades DO NOT MODIFY THIS FILE

    and rather provide your changes in /etc/fail2ban/jail.local

  2. Watch denyhosts turned as unmaintained.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.