Bug 189127 - Trouble with recent module - one packet is seen more than one time
Trouble with recent module - one packet is seen more than one time
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: kernel (Show other bugs)
i686 Linux
medium Severity medium
: ---
: ---
Assigned To: Thomas Graf
Brian Brock
: Security
Depends On:
Blocks: 181409
  Show dependency treegraph
Reported: 2006-04-17 11:35 EDT by Uwe Beck
Modified: 2014-06-18 04:29 EDT (History)
2 users (show)

See Also:
Fixed In Version: RHSA-2006-0575
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2006-08-10 19:08:51 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Uwe Beck 2006-04-17 11:35:32 EDT
Description of problem:

With recent module it is possible to protection you against SSH-brute-force
This is an easy way with four iptables rules with contain also a SSH_WHITELIST.

The recent module does not work correct every time. At this time the recent
module is only use for ssh.

1. after boot you have to wait before you can login over network with ssh
2. after some day there are the same effects like boot the system

In the cases you can not login over ssh we see one packet more than on time in
the /proc/net/ipt_recent/SSH table.

Version-Release number of selected component (if applicable):
kernel-smp-2.6.9-34.EL, iptables-1.2.11-3.1.RHEL4

How reproducible:
- at boot time
- after some time the rules are active, no login, wait, login

Steps to Reproduce:
1. boot the system and login over network with ssh
2. login over network with ssh after some hours or days
Actual results:
see one packet more then one time -> SSH_WHITELIST is ignored

Expected results:
one packet should be only one time in /proc/net/ipt_recent/SSH

Additional info:
For more details and sysreports look at IT_91827 please.
Comment 2 Josef Bacik 2006-04-20 15:29:47 EDT
putting on u5 proposed.
Comment 3 Jason Baron 2006-04-20 23:32:14 EDT
committed in stream U4 build 34.21. A test kernel with this patch is available
from http://people.redhat.com/~jbaron/rhel4/
Comment 4 Uwe Beck 2006-04-21 12:30:07 EDT
Results with i686 kernels from http://people.redhat.com/~jbaron/rhel4/ and
with own fixed kernels:

1. The problem at boot time is fixed with
Patch5031: linux-2.6.9-CAN-2005-2872-ipt-recent.patch

2. See one packet more than one time in /proc/net/ipt_recent/SSH.
Details from the first tests today can find in IT_91827.

I will look if we have problems in the next days again.
Comment 8 Uwe Beck 2006-07-02 05:34:01 EDT
Last system boot with fixed kernel was on Apr 21. No problem since there.
There was only one restart of the firewall script for some new rules.
This restart was without unload the iptables modules.
Comment 10 Red Hat Bugzilla 2006-08-10 19:08:51 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.