Red Hat Bugzilla – Bug 189127
Trouble with recent module - one packet is seen more than one time
Last modified: 2014-06-18 04:29:03 EDT
Description of problem: With recent module it is possible to protection you against SSH-brute-force attacks. This is an easy way with four iptables rules with contain also a SSH_WHITELIST. The recent module does not work correct every time. At this time the recent module is only use for ssh. 1. after boot you have to wait before you can login over network with ssh 2. after some day there are the same effects like boot the system In the cases you can not login over ssh we see one packet more than on time in the /proc/net/ipt_recent/SSH table. Version-Release number of selected component (if applicable): kernel-smp-2.6.9-34.EL, iptables-1.2.11-3.1.RHEL4 How reproducible: - at boot time - after some time the rules are active, no login, wait, login Steps to Reproduce: 1. boot the system and login over network with ssh 2. login over network with ssh after some hours or days 3. Actual results: see one packet more then one time -> SSH_WHITELIST is ignored Expected results: one packet should be only one time in /proc/net/ipt_recent/SSH Additional info: For more details and sysreports look at IT_91827 please.
putting on u5 proposed.
committed in stream U4 build 34.21. A test kernel with this patch is available from http://people.redhat.com/~jbaron/rhel4/
Results with i686 kernels from http://people.redhat.com/~jbaron/rhel4/ and with own fixed kernels: 1. The problem at boot time is fixed with Patch5031: linux-2.6.9-CAN-2005-2872-ipt-recent.patch 2. See one packet more than one time in /proc/net/ipt_recent/SSH. Details from the first tests today can find in IT_91827. I will look if we have problems in the next days again.
Last system boot with fixed kernel was on Apr 21. No problem since there. There was only one restart of the firewall script for some new rules. This restart was without unload the iptables modules.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2006-0575.html