I tried to block myself from my own server to test if fail2ban works correctly, so I tried ssh login and used a wrong password over and over. But I was blocked only after 13 failed logins instead of the default 6 fails.
I removed fail2ban with --purge and reinatalled it, so there should be the
/etc/fail2ban/jail.conf now. This is how it looks at my server:
[DEFAULT] # "ignoreip" can be an IP address, a CIDR mask or a DNS host ignoreip = 127.0.0.1 bantime = 600 maxretry = 3 ... [ssh] enabled = true port = ssh filter = sshd logpath = /var/log/auth.log maxretry = 6
So as i understand, for ssh there should be maxretry 6 now. Why could i try 12 times without being blocked?
I also tried a brute-force attack with THC-Hydra:
hydra -l john -P /tmp/pass.txt myserver.de ssh
and there I saw in
hydra tried 20 to 30 attempts in a row without being blocked.
see my log here: http://pastebin.com/PuMdfU2H
some more information:
i uninstalled fail2ban and then I got some messages in
/var/log/auth.log during my
hydra attack like
sshd: Failed password for john from 123.456.123.456 port 54705 ssh2 sshd: Failed password for john from 123.456.123.456 port 54698 ssh2 ... sshd: PAM service(sshd) ignoring max retries; 5 > 3 ... sshd: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= ... sshd: PAM service(sshd) ignoring max retries; 6 > 3
maybe ssh is redirected on another port each time?
I didn't get blocked this time, so fail2ban is kind of working, if installed.