LinuxQuestions.org
Go Job Hunting at the LQ Job Marketplace
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices



Reply
 
Search this Thread
Old 10-29-2009, 10:23 AM   #1
dlugasx
Member
 
Registered: Dec 2008
Location: Germany/Poland
Distribution: CentOS / Debian / Solaris / RedHat
Posts: 250

Rep: Reputation: 18
Too many authentication failures for user - ssh problem


Quote:
Received disconnect from xx.xxx.xx.xx: 2: Too many authentication failures for user
Does anybody knows what should I do with that command ?

How can I reset failures number on the server.


I have tried with faillog... doesnt work.


hellpp...
 
Old 10-29-2009, 07:01 PM   #2
alpha01
Member
 
Registered: Jul 2008
Location: Orange County
Distribution: Ubuntu/Debian, CentOS, RHEL, FreeBSD, OS X
Posts: 75

Rep: Reputation: 19
Not sure what you man by "I have tried with faillog... doesnt work." But you can try blocking that ip.

iptables -A INPUT -s XX.XX.XX.2 -j DROP
iptables -A OUTPUT -d xx.xx.xx.2 -j DROP
 
Old 10-30-2009, 12:01 AM   #3
edenCC
Member
 
Registered: May 2006
Location: Gz,China
Distribution: RH,FB
Posts: 196
Blog Entries: 1

Rep: Reputation: 32
As for my experience, use a non-standard SSH port is the easiest way to get rid of such noise...

Alternative ways can be used to block these bad eggs directly, e.g. fail2ban
 
Old 08-03-2011, 11:34 PM   #4
qneill
LQ Newbie
 
Registered: Jul 2004
Location: Austin, TX, USA
Posts: 9

Rep: Reputation: 0
Maybe OP was reporting a client side problem?

I think both replies assumed OP was trying to block activity on the server.

But I found this thread when I was debugging a ~/.ssh/config glitch which caused the wrong key to be used. Since PasswordAuthentication was disabled on the server, I saw "Too many authentication failures".

To the OP if you're still out there, re: to the thread if you want help debugging a client side connection.
 
Old 08-04-2011, 01:03 PM   #5
dmelo87
LQ Newbie
 
Registered: Aug 2011
Posts: 1

Rep: Reputation: Disabled
I agree with the other guys, there is a few measures you might wanna take in order to increase security:
  • Put ssh on a non-standard port
  • ban the ips that was causing trouble with iptables
  • define on the ssh config the set of users that can login with ssh (its good to exclude users like postgres that are created by default when you install systems)
  • disable root login


---------- Post added 08-04-11 at 12:04 PM ----------

Btw... there is a set of ssh tricks on this post also... http://diogomelo.net/blog/09/ssh-tricks
 
  


Reply

Tags
authentication, user


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Too Amany Authentication Failures, when I ssh into a server thllgo Linux - Security 2 03-24-2012 08:17 PM
bash script that checks authentication failures and sends mail panoskan Programming 4 06-06-2009 06:24 PM
root Authentication failures baldur2630 Linux - Security 8 11-25-2008 01:47 PM
SSH authentication problem msteiner Linux - Software 6 04-05-2007 02:10 PM
SSH Authentication problem centaur Linux - Networking 1 08-30-2001 06:28 PM


All times are GMT -5. The time now is 08:18 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration