Red Hat Bugzilla – Bug 189127
Trouble with recent module - one packet is seen more than one time
Last modified: 2014-06-18 04:29:03 EDT
Description of problem:
With recent module it is possible to protection you against SSH-brute-force
This is an easy way with four iptables rules with contain also a SSH_WHITELIST.
The recent module does not work correct every time. At this time the recent
module is only use for ssh.
1. after boot you have to wait before you can login over network with ssh
2. after some day there are the same effects like boot the system
In the cases you can not login over ssh we see one packet more than on time in
the /proc/net/ipt_recent/SSH table.
Version-Release number of selected component (if applicable):
- at boot time
- after some time the rules are active, no login, wait, login
Steps to Reproduce:
1. boot the system and login over network with ssh
2. login over network with ssh after some hours or days
see one packet more then one time -> SSH_WHITELIST is ignored
one packet should be only one time in /proc/net/ipt_recent/SSH
For more details and sysreports look at IT_91827 please.
putting on u5 proposed.
committed in stream U4 build 34.21. A test kernel with this patch is available
Results with i686 kernels from http://people.redhat.com/~jbaron/rhel4/ and
with own fixed kernels:
1. The problem at boot time is fixed with
2. See one packet more than one time in /proc/net/ipt_recent/SSH.
Details from the first tests today can find in IT_91827.
I will look if we have problems in the next days again.
Last system boot with fixed kernel was on Apr 21. No problem since there.
There was only one restart of the firewall script for some new rules.
This restart was without unload the iptables modules.
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.