fail2ban is doing nothing?

Discussion in 'Server Operation' started by rlischer, Aug 4, 2009.

  1. rlischer

    rlischer HowtoForge Supporter

    I modified fail2ban config file as seen below. Restarted, service, and then I went to a remote PC and tried to hack in via ssh using bad root passwords and it let me try 100 time and never banned the IP I was coming in on. What did I do wrong? Do I need to set a path somewhere to my host.deny file or something. Thanks


    Code:
    # Fail2Ban configuration file
    #
    # Author: Cyril Jaquier
    #
    # $Revision: 617 $
    #
    
    # The DEFAULT allows a global definition of the options. They can be override
    # in each jail afterwards.
    
    [DEFAULT]
    
    # "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
    # ban a host which matches an address in this list. Several addresses can be
    # defined using space separator.
    ignoreip = 127.0.0.1
    
    # "bantime" is the number of seconds that a host is banned.
    bantime  = 600
    
    # A host is banned if it has generated "maxretry" during the last "findtime"
    # seconds.
    findtime  = 600
    
    # "maxretry" is the number of failures before a host get banned.
    maxretry = 3
    
    # "backend" specifies the backend used to get files modification. Available
    # options are "gamin", "polling" and "auto". This option can be overridden in
    # each jail too (use "gamin" for a jail and "polling" for another).
    #
    # gamin:   requires Gamin (a file alteration monitor) to be installed. If Gamin
    #          is not installed, Fail2ban will use polling.
    # polling: uses a polling algorithm which does not require external libraries.
    # auto:    will choose Gamin if available and polling otherwise.
    backend = auto
    
    
    # This jail corresponds to the standard configuration in Fail2ban 0.6.
    # The mail-whois action send a notification e-mail with a whois request
    # in the body.
    
    [ssh-iptables]
    
    enabled  = true
    filter   = sshd
    action   = iptables[name=SSH, port=ssh, protocol=tcp]
               sendmail-whois[name=SSH, dest=myemailaddress@gmail.com, sender=myemailaddress@anotherplace.com]
    logpath  = /var/log/sshd.log
    maxretry = 3
    
    [proftpd-iptables]
    
    enabled  = true
    filter   = proftpd
    action   = iptables[name=ProFTPD, port=ftp, protocol=tcp]
               sendmail-whois[name=ProFTPD, dest=myemailaddress@gmail.com, sender=myemailaddress@anotherplace.com]
    logpath  = /var/log/proftpd/proftpd.log
    maxretry = 3
    
    # This jail forces the backend to "polling".
    
    [sasl-iptables]
    
    enabled  = true
    filter   = sasl
    backend  = polling
    action   = iptables[name=sasl, port=smtp, protocol=tcp]
               sendmail-whois[name=sasl, dest=myemailaddress@gmail.com, sender=myemailaddress@anotherplace.com]
    logpath  = /var/log/mail.log
    
    # Here we use TCP-Wrappers instead of Netfilter/Iptables. "ignoreregex" is
    # used to avoid banning the user "myuser".
    
    [ssh-tcpwrapper]
    
    enabled     = true
    filter      = sshd
    action      = hostsdeny
                  sendmail-whois[name=SSH, dest=myemailaddress@gmail.com, sender=myemailaddress@anotherplace.com]
    ignoreregex = for myuser from
    logpath     = /var/log/sshd.log
    
    # This jail demonstrates the use of wildcards in "logpath".
    # Moreover, it is possible to give other files on a new line.
    
    [apache-tcpwrapper]
    
    enabled  = true
    filter   = apache-auth
    action   = hostsdeny
    logpath  = /var/log/apache*/*error.log
               /home/www/myhomepage/error.log
    maxretry = 3
    
    # The hosts.deny path can be defined with the "file" argument if it is
    # not in /etc.
    
    [postfix-tcpwrapper]
    
    enabled  = true
    filter   = postfix
    action   = hostsdeny[file=/not/a/standard/path/hosts.deny]
               sendmail[name=Postfix, dest=myemailaddress@gmail.com, sender=myemailaddress@anotherplace.com]
    logpath  = /var/log/postfix.log
    bantime  = 300
    
    # Do not ban anybody. Just report information about the remote host.
    # A notification is sent at most every 600 seconds (bantime).
    
    [vsftpd-notification]
    
    enabled  = true
    filter   = vsftpd
    action   = sendmail-whois[name=VSFTPD, dest=myemailaddress@gmail.com, sender=myemailaddress@anotherplace.com]
    logpath  = /var/log/vsftpd.log
    maxretry = 5
    bantime  = 1800
    
    # Same as above but with banning the IP address.
    
    [vsftpd-iptables]
    
    enabled  = true
    filter   = vsftpd
    action   = iptables[name=VSFTPD, port=ftp, protocol=tcp]
               sendmail-whois[name=VSFTPD, dest=myemailaddress@gmail.com, sender=myemailaddress@anotherplace.com]
    logpath  = /var/log/vsftpd.log
    maxretry = 5
    bantime  = 1800
    
    # Ban hosts which agent identifies spammer robots crawling the web
    # for email addresses. The mail outputs are buffered.
    
    [apache-badbots]
    
    enabled  = true
    filter   = apache-badbots
    action   = iptables-multiport[name=BadBots, port="http,https"]
               sendmail-buffered[name=BadBots, lines=5, dest=myemailaddress@gmail.com, sender=myemailaddress@anotherplace.com]
    logpath  = /var/www/*/logs/access_log
    bantime  = 172800
    maxretry = 1
    
    # Use shorewall instead of iptables.
    
    [apache-shorewall]
    
    enabled  = true
    filter   = apache-noscript
    action   = shorewall
               sendmail[name=Postfix, dest=myemailaddress@gmail.com, sender=myemailaddress@anotherplace.com]
    logpath  = /var/log/apache2/error_log
    
    # This jail uses ipfw, the standard firewall on FreeBSD. The "ignoreip"
    # option is overridden in this jail. Moreover, the action "mail-whois" defines
    # the variable "name" which contains a comma using "". The characters '' are
    # valid too.
    
    [ssh-ipfw]
    
    enabled  = true
    filter   = sshd
    action   = ipfw[localhost=192.168.0.1]
               sendmail-whois[name="SSH,IPFW", dest=myemailaddress@gmail.com, sender=myemailaddress@anotherplace.com]
    logpath  = /var/log/auth.log
    ignoreip = 168.192.0.1
    
    # These jails block attacks against named (bind9). By default, logging is off
    # with bind9 installation. You will need something like this:
    #
    # logging {
    #     channel security_file {
    #         file "/var/log/named/security.log" versions 3 size 30m;
    #         severity dynamic;
    #         print-time yes;
    #     };
    #     category security {
    #         security_file;
    #     };
    # }
    #
    # in your named.conf to provide proper logging.
    # This jail blocks UDP traffic for DNS requests.
    
    [named-refused-udp]
    
    enabled  = true
    filter   = named-refused
    action   = iptables-multiport[name=Named, port="domain,953", protocol=udp]
               sendmail-whois[name=Named, dest=myemailaddress@gmail.com, sender=myemailaddress@anotherplace.com]
    logpath  = /var/log/named/security.log
    ignoreip = 168.192.0.1
    
    # This jail blocks TCP traffic for DNS requests.
    
    [named-refused-tcp]
    
    enabled  = true
    filter   = named-refused
    action   = iptables-multiport[name=Named, port="domain,953", protocol=tcp]
               sendmail-whois[name=Named, dest=myemailaddress@gmail.com, sender=myemailaddress@anotherplace.com]
    logpath  = /var/log/named/security.log
    ignoreip = 168.192.0.1
    
    

    Here is the log. It never shows the actual ip, it just says <ip>. And it never did ban me.

    Code:
    The IP has just been banned by Fail2Ban after
    attempts against .\n\n
    Here are more information about :\n
    `/usr/bin/whois `\n
    Regards,\n
    Fail2Ban" | /usr/sbin/sendmail -f 
    2009-08-03 21:02:17,921 fail2ban.actions.action: INFO Set actionStop = printf %b "Subject: [Fail2Ban] : stopped
    From: Fail2Ban <>
    To: \n
    Hi,\n
    The jail has been stopped.\n
    Regards,\n
    Fail2Ban" | /usr/sbin/sendmail -f 
    2009-08-03 21:02:17,923 fail2ban.actions.action: INFO Set actionStart = printf %b "Subject: [Fail2Ban] : started
    From: Fail2Ban <>
    To: \n
    Hi,\n
    The jail has been started successfully.\n
    Regards,\n
    Fail2Ban" | /usr/sbin/sendmail -f 
    2009-08-03 21:02:17,926 fail2ban.actions.action: INFO Set actionUnban = 
    2009-08-03 21:02:17,928 fail2ban.actions.action: INFO Set actionCheck = 
    2009-08-03 21:02:17,934 fail2ban.jail : INFO Using Gamin
    2009-08-03 21:02:17,936 fail2ban.filter : INFO Created Filter
    2009-08-03 21:02:17,936 fail2ban.filter : INFO Created FilterGamin
    2009-08-03 21:02:17,939 fail2ban.filter : INFO Set maxRetry = 3
    2009-08-03 21:02:17,942 fail2ban.filter : INFO Set findtime = 600
    2009-08-03 21:02:17,944 fail2ban.actions: INFO Set banTime = 600
    2009-08-03 21:02:17,950 fail2ban.actions.action: INFO Set actionBan = iptables -I fail2ban- 1 -s -j DROP
    2009-08-03 21:02:17,952 fail2ban.actions.action: INFO Set actionStop = iptables -D INPUT -p -m multiport --dports -j fail2ban-
    iptables -F fail2ban-
    iptables -X fail2ban-
    2009-08-03 21:02:17,954 fail2ban.actions.action: INFO Set actionStart = iptables -N fail2ban-
    iptables -A fail2ban- -j RETURN
    iptables -I INPUT -p -m multiport --dports -j fail2ban-
    2009-08-03 21:02:17,957 fail2ban.actions.action: INFO Set actionUnban = iptables -D fail2ban- -s -j DROP
    2009-08-03 21:02:17,959 fail2ban.actions.action: INFO Set actionCheck = iptables -n -L INPUT | grep -q fail2ban-
    2009-08-03 21:02:17,967 fail2ban.actions.action: INFO Set actionBan = printf %b "Subject: [Fail2Ban] : banned 
    From: Fail2Ban <>
    To: \n
    Hi,\n
    The IP has just been banned by Fail2Ban after
    attempts against .\n\n
    Here are more information about :\n
    `/usr/bin/whois `\n
    Regards,\n
    Fail2Ban" | /usr/sbin/sendmail -f 
    2009-08-03 21:02:17,970 fail2ban.actions.action: INFO Set actionStop = printf %b "Subject: [Fail2Ban] : stopped
    From: Fail2Ban <>
    To: \n
    Hi,\n
    The jail has been stopped.\n
    Regards,\n
    Fail2Ban" | /usr/sbin/sendmail -f 
    2009-08-03 21:02:17,972 fail2ban.actions.action: INFO Set actionStart = printf %b "Subject: [Fail2Ban] : started
    From: Fail2Ban <>
    To: \n
    Hi,\n
    The jail has been started successfully.\n
    Regards,\n
    Fail2Ban" | /usr/sbin/sendmail -f 
    2009-08-03 21:02:17,975 fail2ban.actions.action: INFO Set actionUnban = 
    2009-08-03 21:02:17,977 fail2ban.actions.action: INFO Set actionCheck = 
    2009-08-03 21:02:17,983 fail2ban.jail : INFO Using Gamin
    2009-08-03 21:02:17,985 fail2ban.filter : INFO Created Filter
    2009-08-03 21:02:17,985 fail2ban.filter : INFO Created FilterGamin
    2009-08-03 21:02:17,988 fail2ban.filter : INFO Set maxRetry = 5
    2009-08-03 21:02:17,991 fail2ban.filter : INFO Set findtime = 600
    2009-08-03 21:02:17,993 fail2ban.actions: INFO Set banTime = 1800
    2009-08-03 21:02:18,008 fail2ban.actions.action: INFO Set actionBan = printf %b "Subject: [Fail2Ban] : banned 
    From: Fail2Ban <>
    To: \n
    Hi,\n
    The IP has just been banned by Fail2Ban after
    attempts against .\n\n
    Here are more information about :\n
    `/usr/bin/whois `\n
    Regards,\n
    Fail2Ban" | /usr/sbin/sendmail -f 
    2009-08-03 21:02:18,011 fail2ban.actions.action: INFO Set actionStop = printf %b "Subject: [Fail2Ban] : stopped
    From: Fail2Ban <>
    To: \n
    Hi,\n
    The jail has been stopped.\n
    Regards,\n
    Fail2Ban" | /usr/sbin/sendmail -f 
    2009-08-03 21:02:18,013 fail2ban.actions.action: INFO Set actionStart = printf %b "Subject: [Fail2Ban] : started
    From: Fail2Ban <>
    To: \n
    Hi,\n
    The jail has been started successfully.\n
    Regards,\n
    Fail2Ban" | /usr/sbin/sendmail -f 
    2009-08-03 21:02:18,016 fail2ban.actions.action: INFO Set actionUnban = 
    2009-08-03 21:02:18,018 fail2ban.actions.action: INFO Set actionCheck = 
    2009-08-03 21:02:18,025 fail2ban.jail : INFO Using Gamin
    2009-08-03 21:02:18,026 fail2ban.filter : INFO Created Filter
    2009-08-03 21:02:18,026 fail2ban.filter : INFO Created FilterGamin
    2009-08-03 21:02:18,029 fail2ban.filter : INFO Set maxRetry = 3
    2009-08-03 21:02:18,032 fail2ban.comm : WARNING Invalid command: ['set', 'ssh-tcpwrapper', 'ignoreregex', 'for myuser from']
    
    
     
  2. gscott187

    gscott187 New Member

    fail2ban sshd

    What flavour of Linux are you using?

    The most obvious thing that springs to mind is the log file specified in jail.conf. Is it really /var/log/sshd.log where SSH access attempts are logged on your system? In CentOS for example, SSH log attempts are logged to: /var/log/secure.
     
  3. rlischer

    rlischer HowtoForge Supporter

    I run centoOS 5.3. So do I need to edit a path in jail.conf ?
     
  4. gscott187

    gscott187 New Member

    fail2ban SSH

    In CentOS 5.3 edit the file /etc/fail2ban/jail.conf for the [ssh-iptables] entry such that the line beginning with logpath... is altered to that shown in red below.

    [ssh-iptables]
    enabled = true
    filter = sshd
    action = iptables[name=SSH, port=ssh, protocol=tcp]
    sendmail-whois[name=SSH, dest=me@mysystem.com, sender=fail2ban@mysystem.com]
    logpath = /var/log/secure
    maxretry = 4


    You can view /var/log/secure before you make these changes to verify that SSH attempts are logged here.

    After editing jail.conf don't forget to restart fail2ban with the command:

    # service fail2ban restart

    If you get an OK when fail2ban starts (i.e. the process has started), test it again and see if you're blocked after maxretry attempts.
     
  5. rlischer

    rlischer HowtoForge Supporter

    Thanks! I changed the config, restarted fail2ban. I did verify that /var/log/secure had information in it. I tried to hack in as root with bad passwords, but it keeps letting me try.

    The log says I was banned, but it lies:
    Code:
    The IP has just been banned by Fail2Ban after
    attempts against .\n\n
    Here are more information about :\n
    `/usr/bin/whois `\n
    Regards,\n
    Fail2Ban" | /usr/sbin/sendmail -f 
    2009-08-04 07:38:10,866 fail2ban.actions.action: INFO Set actionStop = printf %b "Subject: [Fail2Ban] : stopped
    From: Fail2Ban <>
    To: \n
    Hi,\n
    The jail has been stopped.\n
    Regards,\n
    Fail2Ban" | /usr/sbin/sendmail -f 
    2009-08-04 07:38:10,869 fail2ban.actions.action: INFO Set actionStart = printf %b "Subject: [Fail2Ban] : started
    From: Fail2Ban <>
    To: \n
    Hi,\n
    The jail has been started successfully.\n
    
    
     
  6. gscott187

    gscott187 New Member

    fail2ban not working

    If /var/log/secure contains the correct source IP address of the unauthorised login attempt, the next thing to try is running the command:

    fail2ban-regex /var/log/secure /etc/fail2ban/filter.d/sshd.conf

    fail2ban will look at the /var/log/secure file for error conditions associated with ssh. Post the output so I can see what it says.

    I'm assuming that the /etc/fail2ban/filter.d/sshd.conf file exists and has failregex entries similar to those below?


    failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* from <HOST>\s*$
    ^%(__prefix_line)sFailed [-/\w]+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
    ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$
    ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$
    ^%(__prefix_line)sUser \S+ from <HOST> not allowed because not listed in AllowUsers$
    ^%(__prefix_line)sauthentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
    ^%(__prefix_line)srefused connect from \S+ \(<HOST>\)\s*$
    ^%(__prefix_line)sAddress <HOST> .* POSSIBLE BREAK-IN ATTEMPT\s*$


    Each line is a regular expression pattern that fail2ban tries to match in the /var/log/secure file. I would expect a failed ssh login to match at least one of the failregex lines above.
     
    Last edited: Aug 6, 2009
  7. gscott187

    gscott187 New Member

    fail2ban not working

    Something else that occurs to me is iptables. You must be actively using it as your firewall as fail2ban creates a temporary drop rule for the bad source address in /var/log/secure.

    If you've done a CentOS 5.3/ISPConfig3 setup, by default the iptables firewall is off. In ISPConfig3 there is a Bastille version which I would recommend that you don't enable as I find it too restricting. Instead, I enable the CentOS version of iptables. The one that creates /etc/sysconfig/iptables rules.
     
  8. rlischer

    rlischer HowtoForge Supporter

    I don't know if I have a firewall enabled at all. I do see that people are trying to hack in all day long and failing to get the root password correct.
    Do you see something missing here? Thanks!!!!

    Here is my sshd.conf

    Code:
    # Fail2Ban configuration file
    #
    # Author: Cyril Jaquier
    #
    # $Revision: 663 $
    #
    
    [INCLUDES]
    
    # Read common prefixes. If any customizations available -- read them from
    # common.local
    before = common.conf
    
    
    [Definition]
    
    _daemon = sshd
    
    # Option:  failregex
    # Notes.:  regex to match the password failures messages in the logfile. The
    #          host must be matched by a group named "host". The tag "<HOST>" can
    #          be used for standard IP/hostname matching and is only an alias for
    #          (?:::f{4,6}:)?(?P<host>\S+)
    # Values:  TEXT
    #
    failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* from <HOST>\s*$
                ^%(__prefix_line)sFailed [-/\w]+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
                ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$
                ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$
                ^%(__prefix_line)sUser \S+ from <HOST> not allowed because not listed in AllowUsers$
                ^%(__prefix_line)sauthentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
                ^%(__prefix_line)srefused connect from \S+ \(<HOST>\)\s*$
                ^%(__prefix_line)sAddress <HOST> .* POSSIBLE BREAK-IN ATTEMPT\s*$
    
    # Option:  ignoreregex
    # Notes.:  regex to ignore. If this regex matches, the line is ignored.
    # Values:  TEXT
    #
    ignoreregex =
    
    
    Here are the results of your test:

    Code:
    
    Date template hits:
    104241 hit(s): Month Day Hour:Minute:Second
    0 hit(s): Weekday Month Day Hour:Minute:Second Year
    0 hit(s): Weekday Month Day Hour:Minute:Second
    0 hit(s): Year/Month/Day Hour:Minute:Second
    0 hit(s): Day/Month/Year:Hour:Minute:Second
    0 hit(s): Year-Month-Day Hour:Minute:Second
    0 hit(s): Day-Month-Year Hour:Minute:Second[.Millisecond]
    0 hit(s): TAI64N
    0 hit(s): Epoch
    
    Success, the total number of match is 3657
    
    However, look at the above section 'Running tests' which could contain important
    information.
    
    
     
  9. gscott187

    gscott187 New Member

    Fail2ban not working

    To see if iptables is running type:

    service iptables status


    You'll get a reasonably long output message showing what's being filtered.

    If it is not running, you'll need to start it for fail2ban to work. If you're not running iptables, presumably you have another firewall that is protecting your box from evil hackers?
     
  10. rlischer

    rlischer HowtoForge Supporter

    It said Firewall is stopped.

    So start it? Can I make it stay started even after a reboot?
     
  11. rlischer

    rlischer HowtoForge Supporter

    iptables refuses to start, no errors, even after reboot, nothing.

    tried
    Code:
    chkconfig iptables on
    
    Code:
    service iptables start
    
    Code:
    /etc/init.d/iptables start
    
     
  12. gscott187

    gscott187 New Member

    fail2ban not working

    You can start iptables firewall with the command:

    system-config-securitylevel-tui

    This screen is text and may not show that well on a terminal but you can Tab around well enough. Tab to where it shows Security Level and press spacebar to leave an asterisk against Enabled.

    Tab to SELinux and leave as Disabled

    Tab to OK and press Enter

    This will start the firewall and create all of the right files etc.


    To determine the run levels in which ipables will start, type:

    chkconfig --list iptables

    you should see:

    iptables 0:eek:ff 1:eek:ff 2:eek:n 3:eek:n 4:eek:n 5:eek:n 6:eek:ff


    This shows that ipables will start in run levels 2 through 5 (the default run level and what you're most likely in now is 3).
     
  13. rlischer

    rlischer HowtoForge Supporter

    Thanks. It says this now:

    Code:
    [root@server ~]# service iptables status
    Table: filter
    Chain INPUT (policy ACCEPT)
    num  target     prot opt source               destination
    1    RH-Firewall-1-INPUT  all  --  0.0.0.0/0            0.0.0.0/0
    
    Chain FORWARD (policy ACCEPT)
    num  target     prot opt source               destination
    1    RH-Firewall-1-INPUT  all  --  0.0.0.0/0            0.0.0.0/0
    
    Chain OUTPUT (policy ACCEPT)
    num  target     prot opt source               destination
    
    Chain RH-Firewall-1-INPUT (2 references)
    num  target     prot opt source               destination
    1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
    2    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 255
    3    ACCEPT     esp  --  0.0.0.0/0            0.0.0.0/0
    4    ACCEPT     ah   --  0.0.0.0/0            0.0.0.0/0
    5    ACCEPT     udp  --  0.0.0.0/0            224.0.0.251         udp dpt:5353
    6    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:631
    7    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:631
    8    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    9    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22
    10   REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited
    
     
  14. rlischer

    rlischer HowtoForge Supporter

    I think it is blocking my sites now. I have no idea what ports I need open, of course 80, 21 for web ftp, but email, squerrel mail and anything else I don't know how to open?
     
  15. gscott187

    gscott187 New Member

    fail2ban not working

    So fail2ban appears to be working - good.

    The iptables output shown is the default filter. This needs to be configured for your requirements. One of the things I advise you change are the default policy for INPUT and FORWARD chains from ACCEPT to DROP.

    I've sent a HowTo on SquirrelMail and fail2ban to Falko that will be published here in the next few days (once it's been vetted). So if you're interested in setting up SquirrelMail with fail2ban be sure to read that. There's a few gotchas that can catch people out setting this one up.

    As far as inbound ports/services to open, it all depends on what you intend running. For example:

    Web - port 80 (http)
    Secure Web - port 443 (https)
    Plain text email - port 25, 110, 143 (smtp, POP3, IMAP4)
    File transfer - port 20, 21 (ftp)
    Secure Shell - port 22 (ssh)

    There are several others but be very conservative and ask yourself what you REALLY need open.
     
  16. rlischer

    rlischer HowtoForge Supporter

    Thanks! I will be watching for your howto.
     
  17. discoverlinux

    discoverlinux New Member

    I saw the same error and I had enabled (set to true) ssh-iptables and ssh-tcpwrapper. Setting ssh-tcpwrapper back to false removed the error.
     

Share This Page