-
-
Notifications
You must be signed in to change notification settings - Fork 1.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
sshd filter doesn't ban repeated failed publickey attempts #2765
Comments
There are already several issues like this... Shortly - it's not really a bug, and... Although since 9137c7b (not yet released in 0.11.1) the filter gets extended with parameter
But as one can see per default it's still Here are different variants how current version of the filter behaves on your log-excerpt, depending on filter parameters:
I must admit we should rethink about default handling on public key failures (e. g. |
Thank you for your comprehensive answer, I didn't initially find the previous issues on this topic that you pointed out. Will wait for the newer fail2ban version to become available on Ubuntu 20.04 LTS in order to use the In the meantime I went for |
fail2ban has been added in an attempt to reduce the number of spam SSH connections attempted on my lightsail instances. The dest parameter for the 'Create the local fail2ban sshd jail configuration file' task is derived to be loaded after any vendor configurations (e.g. jail.d/*.local is loaded after jail.conf or jail.d/*.conf). The mode for the sshd jail has been set to 'ddos' because the 'normal' mode (or the default mode) doesn't ban repeated failed publickey attempts unless the attempt uses an invalid user. A GitHub issue for this is found here, fail2ban/fail2ban#2765.
fail2ban has been added in an attempt to reduce the number of spam SSH connections attempted on my lightsail instances. The dest parameter for the 'Create the local fail2ban sshd jail configuration file' task is derived to be loaded after any vendor configurations (e.g. jail.d/*.local is loaded after jail.conf and jail.d/*.conf). The mode for the sshd jail has been set to 'ddos' because the 'normal' mode (or the default mode) doesn't ban repeated failed publickey attempts unless the attempt uses an invalid user. A GitHub issue for this is found here, fail2ban/fail2ban#2765.
Environment:
The issue:
The ssh server is set to only allow passkey authentication (
sshd_config
:AuthenticationMethods publickey
andPasswordAuthentication no
).The
sshd
filter doesn't seem to ban repeatedFailed publickey
attempts.However, if I try to login with a wrong username, the ban is correctly enforced by the
sshd
filter.Steps to reproduce
Expected behavior
Would have expected the
sshd
filter to be activated in case of multiple failed publickey attempts.Observed behavior
The filter does not match the login behavior.
Relevant lines from monitored log files in question:
The text was updated successfully, but these errors were encountered: