Blocked IP after failed SSH
fixmyproblem said 2 years, 1 month ago:
Godaddy blocks your IP address after too many consecutive failed SSH password attempts to your shared hosting server.
The IT support refuses to unblock my IP address. They are extremely unresponsive and ineffective at fixing this problem.
They completely deny that this is happening.
I have duplicated the problem 4 times from different ISPs and have uploaded proof to youtube.
Here are the youtube video links:
chrisg said 2 years, 1 month ago:
@fixmyproblem,
My apologies for any inconvenience you may have been encountering in regard to this matter. Please be aware that our network is setup to monitor the number of access attempts into a specific hosting account via SFTP, SSH, or scripts utilizing such functions into an account.
If there are numerous access attempts (Whether successful or failed), the IP address in question is placed in a filter preventing access to our network for a short amount of time. We will not remove the IP address in question until the life span of the filter has expired. This is in place a security feature to protect our network as well as your hosting account.
Christopher G.
fixmyproblem said 2 years, 1 month ago:
Christopher,
Thank you so much for your response. You are the first person at Godaddy to provide an understanding explanation to the problem. I am very relieved.
Can you give me an estimate as to what the life span of the filter is [when it expires]? so I can plan on getting back to work on my site.
Thanks again,
Deryck
chrisg said 2 years, 1 month ago:
@fixmyproblem,
I can’t give the specific time limit that the filter is set to for security reasons. However, I can assure you that it should be a brief period.
If you are still encountering access issues due to the filter for more than an hour, I urge contacting our Server Support team in regards to this so we can investigate the reason for the address still being filtered. To contact our Server Support team, you will want to refer to the information provided in the following URL:
http://support.godaddy.com/help/article/4590
Christopher G.
fixmyproblem said 2 years, 1 month ago:
Christopher,
I understand not being able to give the time limit.
Unfortunately it has been over 24 hours and my IP is still being filtered.
I have however contacted Support, I spoke with 4 different people over there, two of which were managers. None of them even remotely alluded to the filter that is blocking my IP.
I have spent 3 hours and 22 minutes total on the phone with Support as they refuse to acknowledge the filter. I also submitted a support ticket last night.
Please, please put me in touch with someone who has an understanding of the filtering, someone like yourself who can really help me out.
Much appreciated,
Deryck
chrisg said 2 years, 1 month ago:
@fixmyproblem,
My apologies for the misinformation previously received from our Live Support. I have reviewed this matter with our Advanced Hosting support team to verify and confirm the information I had previously provided in this thread.
As you had previously submitted a trouble ticket to our support, I have also investigated into your account to re-open this ticket and forward the information for review with our Advanced Support team. They will be investigating the list of IP addresses provided and responding directly to this ticket once they can determine the reason for the addresses still being blocked for this long.
Again, my apologies for any inconvenience that has been caused. My best wishes in a quick and positive resolution once our advanced support has been able to investigate the matter.
Christopher G.
whatmetoo said 2 years, 1 month ago:
You are not alone in the long lag. I failed a few logins earlier, and my IP has now been blocked for several hours. I opened a ticket too (no response as of yet). Something seems to be broken with the automatic removal of those filters.
It doesn’t help that their SSH daemons are configured to disallow trying 2 usernames. I attempted once with the wrong username, and each time after it just failed saying “You are not allowed to try another username”,and then poof.. IP banned.
I’d rather see them add Google’s 2-factor entries to their PAM configs for added security, than an overly aggressive blocking policy. I’m sure their servers get brute forced 24×7 by thousands of hosts.. but even this is too aggressive.
Brandon Acquav said 2 years, 1 month ago:
Was there ever a resolution to this? I am experiencing something very similar (though not sure if it was SSH as I don’t maintain the site). Site works from everywhere EXCEPT from a specific IP address. GoDaddy phone support wouldn’t give me the time of day and pointed at AT&T for the issue. When I run a tracert on the webserver’s IP address it dies on the last hop which would be the server – there are 3 live hops in GoDaddy land and then the 4th dies. Blocking has been taking place for 4 or 5 days now (that I’m aware of).
fixmyproblem said 2 years, 1 month ago:
Here is an update to my original post:
After over 48 hours my IP’s were finally unblocked.
Unfortunately I dont know if godaddy support had anything to do with fixing it.
I enabled godaddy website protection on the site, then the next morning it was unblocked.
I’m not sure if the people working on my open trouble ticket fixed it, or if the enabling website protection changed the filtering firewall, or if you just need more than 48 hours for the filter to drop your IP. I have no idea.
@whatmetoo,
are you still being blocked?
@Brandon,
My godaddy phone support experience was horrible, I didn’t start to get any traction until I could reference Christopher’s response from above where he acknowledges the filter. If I were you, I would submit a trouble ticket and reference this post.
whatmetoo said 2 years, 1 month ago:
@fixmyproblem
Nope, I remain blocked. Sadly the 3rd IP I had access too, I just failed my login from that too (I really hate that I don’t have my standard username, I always default to try it.. )
So my home cable modem, and both of my shell boxes are blocked. Can’t SSH to my host, can’t access its website either (It seems to completely block you, so I can’t reach my web server port either)
My support ticket got a response almost 24 hours later saying “We’re sending this to a specialist”.
I’m starting to re-think my idea to move more stuff to Godaddy. I had been using it just to host a blog, and this week decided to host more domains and use their Premium DNS.. but if I’m going to get blocked for days on end, and they aren’t able to unblock it, sounds like they are a little broken internally.
whatmetoo said 2 years, 1 month ago:
After calling support, they’ve told me it might take TWO DAYS to resolve this issue. Terrible. That’ll make 3 total days I can’t even view my websites, much less update them or modify files.. short of going to starbucks or something to use their internet.
I’d hate to think what kind of broken IPS they have installed that it takes 2 days to clear “1 hour temporary rules”. I hope they are fixing the larger problem, rather than just fixing each customer who complains. If we didn’t complain, would we be blocked for life?
fixmyproblem said 2 years, 1 month ago:
@whatmetoo – still blocked?
I’d bet the two day estimate they gave you was based on this post and my other trouble ticket complaints.
I setup another test IP that I didn’t report to godaddy on Sunday night. Its been 48 hours and its still blocked. Lets see what happens when unreported.
whatmetoo said 2 years, 1 month ago:
Mine was resolved sometime before 10am California time on Tuesday.. Not sure if it was an automated unblock or someone had to manually touch it.
KungFukittyLa said 2 years, 1 month ago:
Hi,
I too tried to unsuccessfully SSH into my hosting account, without having hosting set up to begin with last night (about 24 hours now).
Soon after my IP and all computers on my network have been blocked from connecting to the website.
I called up GoDaddy support with this question. I explicitly mention that this incident happened right after I unsuccessfully tried to SSH into my website. The CSR looked at a traceroute and quickly blamed the ISP.
I am surprised that this is a known issue that the CSR could not identify or help me with!
FYI, I am using Verizon and the traceroute has about 200 hops when it reaches Qwest.
-Thanks.
fixmyproblem said 2 years, 1 month ago:
My test IP that I used was unblocked after about 60 hours.
I did not report that IP to godaddy.
So that means if they dont do anything it will be unblocked after 60 hours. And they almost certainly are not doing anything about it anyways.
2 min expected wait time