Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

my server currently would temporarily refuse a user to login for certain amount of time (maybe ~20min) if the user consecutively frequent ssh login for 3 times. Can I change this behaviour (say relaxed the definition of frequent maybe from 'within 5 sec' to 'within 10 sec'; or increase the # of consecutive login from 3 to 5)? Thanks.

Added: Ah.. now I think the problem was not with the ssh. I just tried on another newly installed server. consecutive successful login won't block the user. I have no sudo permission on the server I mentioned above. Now I suspect this behaviour may cause by the firewall in the system. Thanks everyone's comments.

ADDED 2: Ah... after some searches. I think the server is using /sbin/iptables to do it as I can see the iptables program is there even though I don't have permission to list the rules. Thanks everyone, special thank to jaume and Mark!

share|improve this question
1  
There's not really enough information here for anyone to help you out -- you need to list your server's OS & Version, and whether any 3rd-party firewall application is installed (and what it is, if there is one). –  PJC Nov 8 '12 at 8:16
    
If you mean that users can't login for 20 min after 3 failed attempts, yes, you can change this behavior. [If you want to know how, please provide more information, as PJC requested: OS and version, SSH version and firewall information (if it is iptables, please provide iptables -S.] –  jaume Nov 8 '12 at 15:18
    
@jaume, no. not changing the consecutive failed login attempt information. The ssh will block the user for certain amount of time when after 3 consecutive frequent successful login. –  Kenneth Nov 9 '12 at 3:59
    
What are you using for blocking them? fail2ban? –  Mark Henderson Nov 9 '12 at 4:01
    
@Mark, I got no idea on what is used to introduce this behaviour on the server. It's annoying and I was thinking may possibly ssh configures that so I asked. But it seems I was wrong. Thanks. –  Kenneth Nov 9 '12 at 4:14
show 2 more comments

1 Answer

I think the program you're looking for is fail2ban. In order to change the number of attempts before blocking you'd need to edit /etc/fail2ban/jail.conf and change 'max retries' for ssh - you can get more information on fail2ban configuration here on fail2ban's website

share|improve this answer
    
I think the op is saying that they are currently blocking incorrect logins, but they want to change the metrics on what triggers a block. Sadly they don't tell us what they're using to currently do the block... –  Mark Henderson Nov 9 '12 at 4:02
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.