#638853 fail2ban: use iptables-new by default for ssh jail

Package:
fail2ban
Source:
fail2ban
Submitter:
Leo 'costela' Antunes
Date:
2011-08-22 21:22:40 UTC
Severity:
wishlist
#638853#5
Date:
2011-08-22 13:28:53 UTC
From:
To:
Hi,

After reading through #350746, I wonder why iptables-new isn't used by
default for the ssh jail.
I understand and agree with the arguments about possible interactions
with other protocols and thus the reason for not using it per default
for all jails, but at least for ssh, where it's clear new auth attempts
will use new connections, this shouldn't have any sensible drawbacks
while decreasing the "annoyance-factor" of locking yourself out of your
own server (like I just did, while playing with the pubkeys used by
automatic backups :D).


Cheers
#638853#15
Date:
2011-08-22 20:50:59 UTC
From:
To:
That's a very good point.
I'm gonna try cooking up a version of iptables-multiport which wraps the
actionban with a check to see if there's a utmp entry from that IP.
Would you accept something like this to be included like iptables-new
currently is? It would deal with the annoying part without hitting this
particular issue (I'd probably test this on at least one server for a
while before submitting anyway).


Cheers
#638853#20
Date:
2011-08-22 21:17:22 UTC
From:
To:
Hi Leo,

sorry, my brain must be resting at the moment, but I would need more
detailed description of what/how you are trying to achieve, to give any
promise ;-)