IP Blocked in UFW, yet continue to see failed password attempts in auth.log
Clash Royale CLAN TAG#URR8PPP up vote
1
down vote
favorite
sudo ufw deny from 182.100.67.120
sudo service ufw restart
Yet, continuous entries in /var/log/auth.log
Feb 18 03:40:01 service sshd[2729]: Failed password for root from 182.100.67.120 port 51942 ssh2
If the IP is banned in UFW, why it is still getting into ssh login?
ufw
asked Feb 18 at 3:41
Allen King
1161
add a comment |Â
up vote
1
down vote
favorite
sudo ufw deny from 182.100.67.120
sudo service ufw restart
Yet, continuous entries in /var/log/auth.log
Feb 18 03:40:01 service sshd[2729]: Failed password for root from 182.100.67.120 port 51942 ssh2
If the IP is banned in UFW, why it is still getting into ssh login?
ufw
asked Feb 18 at 3:41
Allen King
1161
Try " sudo ufw status verbose " and past the output
– Aravind
Feb 18 at 9:48
add a comment |Â
up vote
1
down vote
favorite
up vote
1
down vote
favorite
sudo ufw deny from 182.100.67.120
sudo service ufw restart
Yet, continuous entries in /var/log/auth.log
Feb 18 03:40:01 service sshd[2729]: Failed password for root from 182.100.67.120 port 51942 ssh2
If the IP is banned in UFW, why it is still getting into ssh login?
ufw
asked Feb 18 at 3:41
Allen King
1161
sudo ufw deny from 182.100.67.120
sudo service ufw restart
Yet, continuous entries in /var/log/auth.log
Feb 18 03:40:01 service sshd[2729]: Failed password for root from 182.100.67.120 port 51942 ssh2
If the IP is banned in UFW, why it is still getting into ssh login?
ufw
ufw
asked Feb 18 at 3:41
Allen King
1161
asked Feb 18 at 3:41
Allen King
1161
asked Feb 18 at 3:41
Allen King
1161
asked Feb 18 at 3:41
Allen King
1161
asked Feb 18 at 3:41
Allen King
1161
1161
Try " sudo ufw status verbose " and past the output
– Aravind
Feb 18 at 9:48
add a comment |Â
Try " sudo ufw status verbose " and past the output
– Aravind
Feb 18 at 9:48
Try " sudo ufw status verbose " and past the output
– Aravind
Feb 18 at 9:48
Try " sudo ufw status verbose " and past the output
– Aravind
Feb 18 at 9:48
add a comment |Â
1 Answer
1
active
oldest
votes
up vote
0
down vote
I figured out. Since port 22 is already open from anywhere, to block an IP to port 22, the deny entry has to go above the allow anywhere entry in UFW list. So the right command is (just inserting to the top of the list) :
sudo ufw insert 1 deny from 182.100.67.120
sudo service ufw restart
But before this, first I had to delete the deny entry using:
sudo ufw status numbered
Get the serial number of the previously entered deny entry for the above port, then
sudo ufw delete <serial number >
answered Feb 19 at 4:54
Allen King
1161
add a comment |Â
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
0
down vote
I figured out. Since port 22 is already open from anywhere, to block an IP to port 22, the deny entry has to go above the allow anywhere entry in UFW list. So the right command is (just inserting to the top of the list) :
sudo ufw insert 1 deny from 182.100.67.120
sudo service ufw restart
But before this, first I had to delete the deny entry using:
sudo ufw status numbered
Get the serial number of the previously entered deny entry for the above port, then
sudo ufw delete <serial number >
answered Feb 19 at 4:54
Allen King
1161
add a comment |Â
up vote
0
down vote
I figured out. Since port 22 is already open from anywhere, to block an IP to port 22, the deny entry has to go above the allow anywhere entry in UFW list. So the right command is (just inserting to the top of the list) :
sudo ufw insert 1 deny from 182.100.67.120
sudo service ufw restart
But before this, first I had to delete the deny entry using:
sudo ufw status numbered
Get the serial number of the previously entered deny entry for the above port, then
sudo ufw delete <serial number >
answered Feb 19 at 4:54
Allen King
1161
add a comment |Â
up vote
0
down vote
up vote
0
down vote
I figured out. Since port 22 is already open from anywhere, to block an IP to port 22, the deny entry has to go above the allow anywhere entry in UFW list. So the right command is (just inserting to the top of the list) :
sudo ufw insert 1 deny from 182.100.67.120
sudo service ufw restart
But before this, first I had to delete the deny entry using:
sudo ufw status numbered
Get the serial number of the previously entered deny entry for the above port, then
sudo ufw delete <serial number >
answered Feb 19 at 4:54
Allen King
1161
I figured out. Since port 22 is already open from anywhere, to block an IP to port 22, the deny entry has to go above the allow anywhere entry in UFW list. So the right command is (just inserting to the top of the list) :
sudo ufw insert 1 deny from 182.100.67.120
sudo service ufw restart
But before this, first I had to delete the deny entry using:
sudo ufw status numbered
Get the serial number of the previously entered deny entry for the above port, then
sudo ufw delete <serial number >
answered Feb 19 at 4:54
Allen King
1161
answered Feb 19 at 4:54
Allen King
1161
answered Feb 19 at 4:54
Allen King
1161
answered Feb 19 at 4:54
Allen King
1161
1161
add a comment |Â
add a comment |Â
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1007271%2fip-blocked-in-ufw-yet-continue-to-see-failed-password-attempts-in-auth-log%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Try " sudo ufw status verbose " and past the output
– Aravind
Feb 18 at 9:48