Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

For bugs related to Red Hat Enterprise Linux 4 product line. The current stable release is 4.9. For Red Hat Enterprise Linux 6 and above, please visit Red Hat JIRA https://issues.redhat.com/secure/CreateIssue!default.jspa?pid=12332745 to report new issues.

Bug 189127

Summary:	Trouble with recent module - one packet is seen more than one time
Product:	Red Hat Enterprise Linux 4	Reporter:	Uwe Beck <ubeck>
Component:	kernel	Assignee:	Thomas Graf <tgraf>
Status:	CLOSED ERRATA	QA Contact:	Brian Brock <bbrock>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	4.0	CC:	jbaron, rkhan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	i686
OS:	Linux
Whiteboard:
Fixed In Version:	RHSA-2006-0575	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-08-10 23:08:51 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	181409

Description Uwe Beck 2006-04-17 15:35:32 UTC

Description of problem:

With recent module it is possible to protection you against SSH-brute-force
attacks.
This is an easy way with four iptables rules with contain also a SSH_WHITELIST.

The recent module does not work correct every time. At this time the recent
module is only use for ssh.

1. after boot you have to wait before you can login over network with ssh
2. after some day there are the same effects like boot the system

In the cases you can not login over ssh we see one packet more than on time in
the /proc/net/ipt_recent/SSH table.

Version-Release number of selected component (if applicable):
kernel-smp-2.6.9-34.EL, iptables-1.2.11-3.1.RHEL4

How reproducible:
- at boot time
- after some time the rules are active, no login, wait, login

Steps to Reproduce:
1. boot the system and login over network with ssh
2. login over network with ssh after some hours or days
3.
  
Actual results:
see one packet more then one time -> SSH_WHITELIST is ignored

Expected results:
one packet should be only one time in /proc/net/ipt_recent/SSH

Additional info:
For more details and sysreports look at IT_91827 please.

Comment 2 Josef Bacik 2006-04-20 19:29:47 UTC

putting on u5 proposed.

Comment 3 Jason Baron 2006-04-21 03:32:14 UTC

committed in stream U4 build 34.21. A test kernel with this patch is available
from http://people.redhat.com/~jbaron/rhel4/

Comment 4 Uwe Beck 2006-04-21 16:30:07 UTC

Results with i686 kernels from http://people.redhat.com/~jbaron/rhel4/ and
with own fixed kernels:

1. The problem at boot time is fixed with
Patch5031: linux-2.6.9-CAN-2005-2872-ipt-recent.patch

2. See one packet more than one time in /proc/net/ipt_recent/SSH.
Details from the first tests today can find in IT_91827.

I will look if we have problems in the next days again.

Comment 8 Uwe Beck 2006-07-02 09:34:01 UTC

Last system boot with fixed kernel was on Apr 21. No problem since there.
There was only one restart of the firewall script for some new rules.
This restart was without unload the iptables modules.

Comment 10 Red Hat Bugzilla 2006-08-10 23:08:51 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2006-0575.html