Problems with SSH: IP being banned after consecutive successful x logins

2

I'm having a small problem with SSH from one of the company's servers. The problem is that I am using a monitoring software called Nagios, and as using some other checking mode, such as NRPE, requires the installation of several packages that I prefer not to install, since the server is dedicated, I decided to use check by SSH. I created an access key, for Nagios itself to make the access via SSH and collect the information and everything went well. Now that the problem shows up. Every time I activate the checks on this server, it checks everything normal, but when it goes to the sixth consecutive check, my IP is banned and gives timeout, so I have to go to another server, jump to it and unban my IP, but this way that Nagios will do the checks the IP is already banned again.

Please note, the problem is not in the access key I created, because it works normally, even when I test the command below:

sudo -u nagios ssh nagios@servidor

Or with the Nagios plugin itself:

sudo -u nagios ./check_by_ssh -l nagios -H <ip-do-servidor> -C "<comando>"

The question is how many times that soon. So I noticed, after 5 consecutive logins, in the sixth it already banned my IP.

To make sure it was not something exclusive to Nagios, I did 5 consecutive accesses via the terminal on the server and the 6th blocked as well. The answer in the sixth access is this:

ssh: connect to host <server>.<domain> port <port-number>: Connection timed out

Is there an SSH configuration, perhaps in / etc / ssh / sshd_config or / etc / ssh / ssh_config, which allows you to configure the allowed number of consecutive successful logins? Something like maxretry and bantime?

    
asked by anonymous 29.12.2014 / 17:33

1 answer

2

Hello, I would like to inform you that the problem has been resolved.

Fail2ban counted successful accesses along with unsuccessful accesses because in the /etc/fail2ban/filter.d/sshd.conf file there was a failregex that should be commented out:

^%(__prefix_line)sAddress <HOST> .* POSSIBLE BREAK-IN ATTEMPT!*\s*$

and entered the counter because this phrase always appeared in the login, stating that it is not possible to do reverse IP mapping. I commented and the problem was solved.

    
05.01.2015 / 20:46