What is the fail2ban default setting for SSH login attempts?

Question

I tried to block myself from my own server to test if fail2ban works correctly, so I tried ssh login and used a wrong password over and over. But I was blocked only after 13 failed logins instead of the default 6 fails.

I removed fail2ban with --purge and reinatalled it, so there should be the defaults in /etc/fail2ban/jail.conf now. This is how it looks at my server:

[DEFAULT]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host
ignoreip = 127.0.0.1
bantime  = 600
maxretry = 3

...
[ssh]

enabled = true
port    = ssh
filter  = sshd
logpath  = /var/log/auth.log
maxretry = 6

So as i understand, for ssh there should be maxretry 6 now. Why could i try 12 times without being blocked?

I also tried a brute-force attack with THC-Hydra:

hydra -l john -P /tmp/pass.txt myserver.de ssh

and there I saw in /var/log/auth.log that hydra tried 20 to 30 attempts in a row without being blocked. see my log here: http://pastebin.com/PuMdfU2H

---

some more information:

i uninstalled fail2ban and then I got some messages in /var/log/auth.log during my hydra attack like

sshd[9286]: Failed password for john from 123.456.123.456 port 54705 ssh2
sshd[9286]: Failed password for john from 123.456.123.456 port 54698 ssh2
...
sshd[9280]: PAM service(sshd) ignoring max retries; 5 > 3
...
sshd[9286]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= 
...
sshd[9285]: PAM service(sshd) ignoring max retries; 6 > 3

maybe ssh is redirected on another port each time?

I didn't get blocked this time, so fail2ban is kind of working, if installed.

Answer 1

I think you are seeing a combination of two things:

1. Latency between the time sshd sends the string to the log, the time syslog writes it to the disk, the time fail2ban picks it up, parses it, and and injects an iptables rule into the running set, and the time the kernel starts paying attention to the new filtering rules. This is why you see "Already banned" entries in fail2ban.log.
2. PAM, login.defs and sshd all trying to block successive retries. If you notice, it says sshd[9280]: PAM service(sshd) ignoring max retries; 5 > 3, which PAM telling you that there is "retry=3" in one of its modules (probably /etc/pam.d/password-auth) and it will ignore any further authentication requests from sshd within the same session. Sshd will continue trying until it exhausts MaxAuthTries setting (default is 6, I think), at which point it will terminate the connection. This probably creates different log entries that fail2ban doesn't parse as failed login attempts. Just a guess on this one.

HTH.