# Suspiciously high number of authentication failures?

**URL:** <https://forum.yunohost.org/t/suspiciously-high-number-of-authentication-failures/23775>\
**Category:** Support\
**Tags:** french\
**Created:** [February 22, 2023, 7:33pm UTC](https://forum.yunohost.org/t/suspiciously-high-number-of-authentication-failures/23775 "2023-02-22T19:33:27Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Daz](https://forum.yunohost.org/letter_avatar_proxy/v4/letter/d/87869e/32.png) [@Daz](https://forum.yunohost.org/u/Daz)\
**Post date:** [February 22, 2023, 7:33pm UTC](https://forum.yunohost.org/t/suspiciously-high-number-of-authentication-failures/23775/1 "2023-02-22T19:33:27Z")

</div>

### My YunoHost server

**Hardware:** Olimex Lime 2  
**YunoHost version:** 11.1.7  
**I have access to my server :** Through SSH | through the webadmin |  
**Are you in a special context or did you perform some particular tweaking on your YunoHost instance ?** : my SSH port is already different from the default one.

### Description of my issue

Hi, since February 17th, I got a warning from the diagnosis tool :

> [WARNING] There’s been a suspiciously high number of authentication failures recently. You may want to make sure that fail2ban is running and is correctly configured, or use a custom port for SSH as explained in [https://yunohost.org/security](https://yunohost.org/security).

I don’t understand why, because I didn’t personnaly attempt to login the days before this message. Fail2ban is working and I got nothing suspicious in the logs ([hastebin](https://paste.yunohost.org/ejiwizuvet)). Still I restarted it. My SSH port is already custom. I did nothing before this happened.  
Has someone an idea on what is wrong or how to investigate it ?

---

<div class="post-metadata">

**Author:** ![ljf](https://forum.yunohost.org/user_avatar/forum.yunohost.org/ljf/32/58_2.png) [@ljf](https://forum.yunohost.org/u/ljf)\
**Post date:** [February 22, 2023, 8:59pm UTC](https://forum.yunohost.org/t/suspiciously-high-number-of-authentication-failures/23775/2 "2023-02-22T20:59:28Z")

</div>

Have you change the number with

```auto
yunohost settings set security.ssh.port -v <new_ssh_port_number>

```

Or with the settings interface in the web admin ?

If no it’s possible that fail2ban doesn’t protect your specif port number.

---

<div class="post-metadata">

**Author:** ![Daz](https://forum.yunohost.org/letter_avatar_proxy/v4/letter/d/87869e/32.png) [@Daz](https://forum.yunohost.org/u/Daz)\
**Post date:** [February 23, 2023, 8:21pm UTC](https://forum.yunohost.org/t/suspiciously-high-number-of-authentication-failures/23775/3 "2023-02-23T20:21:05Z")

</div>

I’m not sure because I did it a long time ago when I installed the server, but I think I directly edited the sshd\_config file. By the way, this rises another alert from the diagnosis tool, but since the beginning so I silenced it.  
The web admin prompts the correct custom port. In the firewall, the 22 port is closed, and my custom ssh port is open.  
How can I check which ports are protected by fail2ban ?

---

<div class="post-metadata">

**Author:** ![Daz](https://forum.yunohost.org/letter_avatar_proxy/v4/letter/d/87869e/32.png) [@Daz](https://forum.yunohost.org/u/Daz)\
**Post date:** [March 14, 2023, 10:53pm UTC](https://forum.yunohost.org/t/suspiciously-high-number-of-authentication-failures/23775/4 "2023-03-14T22:53:39Z")

</div>

I still didn’t solve the problem. I tried to change the ssh port from the webadmin but no progress. Does anyone has another idea, what should I check ?

---

<div class="post-metadata">

**Author:** ![Kit](https://forum.yunohost.org/user_avatar/forum.yunohost.org/kit/32/1208_2.png) [@Kit](https://forum.yunohost.org/u/Kit)\
**Post date:** [March 14, 2023, 11:44pm UTC](https://forum.yunohost.org/t/suspiciously-high-number-of-authentication-failures/23775/5 "2023-03-14T23:44:59Z")

</div>

What is the output of this command : `iptables-save | grep INPUT | grep f2b-sshd` ?

You should have something like `-A INPUT -p tcp -m multiport --dports YOURSSHPORT -j f2b-sshd`, with _YOURSSHPORT_ the SSH port number.

---

<div class="post-metadata">

**Author:** ![Daz](https://forum.yunohost.org/letter_avatar_proxy/v4/letter/d/87869e/32.png) [@Daz](https://forum.yunohost.org/u/Daz)\
**Post date:** [March 15, 2023, 7:30pm UTC](https://forum.yunohost.org/t/suspiciously-high-number-of-authentication-failures/23775/6 "2023-03-15T19:30:45Z")

</div>

Interestingly, the command returns nothing.  
When I do : `iptables-save` only  
I got several lines with my open ports, including the one for ssh, but there is no “f2b-sshd” at the end : `-A INPUT -p tcp -m tcp --dport MYSSHPORT -j ACCEPT`

Could it be a symptom of the real issue ?  
I remember a long time ago having a problem by being banned myself from my SSH port (but it was at least 2 versions of Debian ago 😅 ) and I may have change the configuration of fail2ban so as to regain access. I don’t know if this is a lead towards the problem ?

---

<div class="post-metadata">

**Author:** ![Kit](https://forum.yunohost.org/user_avatar/forum.yunohost.org/kit/32/1208_2.png) [@Kit](https://forum.yunohost.org/u/Kit)\
**Post date:** [March 15, 2023, 8:05pm UTC](https://forum.yunohost.org/t/suspiciously-high-number-of-authentication-failures/23775/7 "2023-03-15T20:05:41Z")

</div>

You should have a line like `-A INPUT -p tcp -m multiport --dports MYSSHPORT -j f2b-sshd`

Had more or less the same issue last year (because I done a stupid thing when I tried to add a jail) =\> [SSH : Multiple tentatives de connexion malgré fail2ban - #5 by Kit](https://forum.yunohost.org/t/ssh-multiple-tentatives-de-connexion-malgre-fail2ban/20397/5)

Let’s recheck properly :

- `cat /etc/fail2ban/jail.d/yunohost-jails.conf` : is the sshd jail in the output ? Is the ssh port the new one ?
- `yunohost settings get security.ssh.port` : let’s double-check if the right port is monitored.
- `yunohost service status yunohost-firewall fail2ban`: are the firewall and f2b services running ?
- Did you tried to restart the firewall and f2b services ?

---

<div class="post-metadata">

**Author:** ![Daz](https://forum.yunohost.org/letter_avatar_proxy/v4/letter/d/87869e/32.png) [@Daz](https://forum.yunohost.org/u/Daz)\
**Post date:** [March 15, 2023, 9:44pm UTC](https://forum.yunohost.org/t/suspiciously-high-number-of-authentication-failures/23775/8 "2023-03-15T21:44:45Z")

</div>

> [@Kit](#):
>
> `cat /etc/fail2ban/jail.d/yunohost-jails.conf` : is the sshd jail in the output ? Is the ssh port the new one ?

Yes, I got this, the port is correct :

```auto
[sshd]
port = MYSSHPORT
enabled = true

```

> [@Kit](#):
>
> yunohost settings get security.ssh.port

returns the right port also.

And `yunohost service status yunohost-firewall fail2ban` returns :

```auto
fail2ban: 
  configuration: valid
  description: Protects against brute-force and other kinds of attacks from the Internet
  last_state_change: 2023-03-04 12:15:20
  start_on_boot: enabled
  status: running
yunohost-firewall: 
  configuration: unknown
  description: Manages open and close connection ports to services
  last_state_change: 2023-02-12 23:15:05
  start_on_boot: enabled
  status: running

```

I already restarted my server several times…

By reading your own topic, I looked into my jail.d, and I found a “my\_ssh\_port.conf” file, I think I remember I created it after I got my own IP banned. The file contains :

```auto
[sshd]
port = MYSSHPORT
ignoreip = 192.168.0.17 (<- it is my PC local IP)

[sshd-ddos]
port = MYSSHPORT

```

So it may be a duplicate of the yunohost-jails.conf file, but nothing contradictory.

---

<div class="post-metadata">

**Author:** ![lnoferin](https://forum.yunohost.org/user_avatar/forum.yunohost.org/lnoferin/32/2043_2.png) [@lnoferin](https://forum.yunohost.org/u/lnoferin)\
**Post date:** [April 10, 2023, 7:04am UTC](https://forum.yunohost.org/t/suspiciously-high-number-of-authentication-failures/23775/9 "2023-04-10T07:04:19Z")

</div>

I have the same issue.  
I followed the thread in [SSH : Multiple tentatives de connexion malgré fail2ban](https://forum.yunohost.org/t/ssh-multiple-tentatives-de-connexion-malgre-fail2ban/20397) (for what I could understand from french language) but I could not find any solution.

The only thing I cannot understand is the “invalid” status in the configuration of yunohost-firewall.

---

<div class="post-metadata">

**Author:** ![system](https://forum.yunohost.org/uploads/default/original/2X/f/f59fe8e3ee6b100b4f574d30d6e30479c68b89f0.png) [@system](https://forum.yunohost.org/u/system)\
**Post date:** [May 10, 2023, 7:04am UTC](https://forum.yunohost.org/t/suspiciously-high-number-of-authentication-failures/23775/10 "2023-05-10T07:04:58Z")

</div>

Closed on May 10, 2023, 7:04am UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.