Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

my server currently would temporarily refuse a user to login for certain amount of time (maybe ~20min) if the user consecutively frequent ssh login for 3 times. Can I change this behaviour (say relaxed the definition of frequent maybe from 'within 5 sec' to 'within 10 sec'; or increase the # of consecutive login from 3 to 5)? Thanks.

Added: Ah.. now I think the problem was not with the ssh. I just tried on another newly installed server. consecutive successful login won't block the user. I have no sudo permission on the server I mentioned above. Now I suspect this behaviour may cause by the firewall in the system. Thanks everyone's comments.

ADDED 2: Ah... after some searches. I think the server is using /sbin/iptables to do it as I can see the iptables program is there even though I don't have permission to list the rules. Thanks everyone, special thank to jaume and Mark!

share|improve this question
There's not really enough information here for anyone to help you out -- you need to list your server's OS & Version, and whether any 3rd-party firewall application is installed (and what it is, if there is one). – PJC Nov 8 '12 at 8:16
If you mean that users can't login for 20 min after 3 failed attempts, yes, you can change this behavior. [If you want to know how, please provide more information, as PJC requested: OS and version, SSH version and firewall information (if it is iptables, please provide iptables -S.] – jaume Nov 8 '12 at 15:18
@jaume, no. not changing the consecutive failed login attempt information. The ssh will block the user for certain amount of time when after 3 consecutive frequent successful login. – Kenneth Nov 9 '12 at 3:59
What are you using for blocking them? fail2ban? – Mark Henderson Nov 9 '12 at 4:01
@Mark, I got no idea on what is used to introduce this behaviour on the server. It's annoying and I was thinking may possibly ssh configures that so I asked. But it seems I was wrong. Thanks. – Kenneth Nov 9 '12 at 4:14

I think the program you're looking for is fail2ban. In order to change the number of attempts before blocking you'd need to edit /etc/fail2ban/jail.conf and change 'max retries' for ssh - you can get more information on fail2ban configuration here on fail2ban's website

share|improve this answer
I think the op is saying that they are currently blocking incorrect logins, but they want to change the metrics on what triggers a block. Sadly they don't tell us what they're using to currently do the block... – Mark Henderson Nov 9 '12 at 4:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .