Comment 1 for bug 1669501

Revision history for this message
Matt Bruzek (mbruzek) wrote :

I am able to access the GCE VM using the Google console. I see my IP addresses in the iptable --lis DROP rules! The coffee shop ip address is 96.33.226.42.

Chain sshguard (1 references)
target prot opt source destination
DROP all -- smtp1.orderz.com anywhere
DROP all -- hostby.planet-telecom.eu anywhere
DROP all -- 122.194.229.9 anywhere
DROP all -- 112.85.42.110 anywhere
DROP all -- v157-7-208-112.myvps.jp anywhere
DROP all -- 153.99.182.8 anywhere
DROP all -- 112.85.42.28 anywhere
DROP all -- 112.85.42.22 anywhere
DROP all -- 193.201.224.237 anywhere
DROP all -- 96-42-224-45.dhcp.roch.mn.charter.com anywhere
DROP all -- 123.183.209.136 anywhere
DROP all -- 106.226.86.109.triolan.net anywhere
DROP all -- 146.228.112.199 anywhere
DROP all -- 114.119.7.53 anywhere
DROP all -- fs.sip.gocheepmobile.com anywhere
DROP all -- 120.27.133.147 anywhere
DROP all -- 123.183.209.135 anywhere
DROP all -- 163-172-219-77.rev.poneytelecom.eu anywhere
DROP all -- 96-42-209-188.dhcp.roch.mn.charter.com anywhere
DROP all -- 117.54.13.180 anywhere
DROP all -- 91.224.160.131 anywhere
DROP all -- 46.148.18.163 anywhere

It looks like Juju scp/ssh is doing something that sets off a sshguard rule on GCE VMs. Here is the output from the systemctl status sshguard

Mar 02 15:55:35 juju-25c78b-1 sshguard[1710]: Blocking 96.33.226.42:4 for >630secs: 40 danger in 4 attacks over 907 seconds (all: 40d in 1 abuses over 907s).

The only method of connection was juju ssh/scp to connect to this system and now my IP address is blocked!