sshd_config MaxAuthTries -when does it reset?

dman777 · 08-22-2012, 12:14 AM

When a ipaddress reaches this threshold, what/when does it reset for that ipaddress?

Quote:

MaxAuthTries
Specifies the maximum number of authentication attempts permitted per connection. Once the number of failures reaches half this value, additional failures are logged. The default is 6.

evo2 · 08-22-2012, 12:27 AM

Hi,

from that text in the man page it looks like it resets for each *connection* (nothing to do with the ipaddress). Are you observing some sort of different behaviour?

Evo2.

dman777 · 08-22-2012, 01:19 AM

I would think per a connection would be per a ipddress, if not what would define the "per a connection" criteria(since there is no authentication at this point the daemon does not keep track of the user but the connection)? Yes, the behavior I have is once I reach the threshold, I can no longer log in ever for that user. The work around was to vnc into the host, raise the threshold, login successfully to reset the threshold for that connection. If I didn't do that would that connection be banned from logging in forever?

evo2 · 08-22-2012, 01:46 AM

Hi,

Quote:

Originally Posted by dman777

I would think per a connection would be per a ipddress, if not what would define the "per a connection" criteria(since there is no authentication at this point the daemon does not keep track of the user but the connection)?

A connection to the daemon. Ie from the time that authentication starts on a single ssh instance (to an sshd) and then exits. (but I've been unable to confirm this).

If you read the sshd man page the term "connection" is used very often in a way that is consistent with the definition I am assuming. For example, the section describing running sshd in debug mode

Code:

     -d      Debug mode.  The server sends verbose debug output to standard error, and does not put itself in the
             background.  The server also will not fork and will only process one connection.  This option is only
             intended for debugging for the server.  Multiple -d options increase the debugging level.  Maximum is
             3.

Evo2.

zhjim · 08-22-2012, 01:58 AM

Quote:

Originally Posted by dman777

I would think per a connection would be per a ipddress, if not what would define the "per a connection" criteria(since there is no authentication at this point the daemon does not keep track of the user but the connection)?

The definition of "per a connection" is a new tcp session. Started with the 3 way handshake. Ring any bells?

Quote:

Originally Posted by dman777

Yes, the behavior I have is once I reach the threshold, I can no longer log in ever for that user. The work around was to vnc into the host, raise the threshold, login successfully to reset the threshold for that connection. If I didn't do that would that connection be banned from logging in forever?

I doubt that behavior comes solely from the configuration of the MaxAuthTries. Might be another programm running that blocks your ip from connecting. fail2ban for example.

dman777 · 08-22-2012, 02:40 AM

Quote:

Originally Posted by zhjim

The definition of "per a connection" is a new tcp session. Started with the 3 way handshake. Ring any bells?

I doubt that behavior comes solely from the configuration of the MaxAuthTries. Might be another programm running that blocks your ip from connecting. fail2ban for example.

No, these are all my personal systems and they are bare min. so I know exactly what is running on them. No fail2ban. I had the wrong key, after the first failed attempt I kept getting disconnected with I reached maximum authentication tries messages. It is is not per a TCP handshake. Which brings me back to the original question on what resets this threshold assuming it's the ipaddress that is the source for the unauthenticated session.

evo2 · 08-22-2012, 02:49 AM

Hi,

this is curious. A couple of things to check: have you checked the sshd logs (or better still run sshd -d) to see what is reported when a user is locked out? Also, do you see this behaviour when ssh to localhost (to eliminate possibilities of network, firewall, whatever issues)?

Evo2.

chrism01 · 08-22-2012, 07:36 PM

Are you using pam_tally at all http://www.cyberciti.biz/tips/rhel-c...led-login.html ?