4 ms·
I hear you on this, but how do you feel about programs such as fail2ban. Even if breakable via 18K requests, if the ssh host has fail2ban installed, the attack
by jgalt212 9y ago
I hear you on this, but how do you feel about programs such as fail2ban. Even if breakable via 18K requests, if the ssh host has fail2ban installed, the attacker will never get off those 18K requests (unless, and this is a big unless he/she controls 100s of unique IP addresses).
- tptacek 9y agoI think fail2ban is pointless.
- fosco 9y agoOut of curiosity can you elaborate?
- wcarron 9y agoNot the parent commenter, but could you explain why? AT my work we're setting up a large deployment and I'm planning on configuring fail2ban on all our instances. Is there any downside to doing so that I'm missing?
- tptacek 9y agoThere’s no downside that I know of, but if you’re using keys there’s no upside, and if you’re not exclusively using keys there’s a huge downside to that.
- amaranth 9y agoThe major downside of fail2ban is actually that it punishes you for using keys. If you have different keys for different machines and haven't configured your SSH client to pair them up you might attempt to login several times with the wrong key before getting in. You won't even notice this normally but fail2ban will trigger and ban you from the machine. https://github.com/fail2ban/fail2ban/issues/1263 https://github.com/fail2ban/fail2ban/issues/1263
- kawera 9y agoComing from you, of all people, could you elaborate a bit or point us to some literature?
- 0xdeadbeefbabe 9y agoI'm not him, but this isn't a surprise to me at least from the don't-roll-your-own-crypto guy. It probably has something to do with this: > Fail2Ban is able to reduce the rate of incorrect authentications attempts however it cannot eliminate the risk that weak authentication presents
- kardos 9y agoI am also not him. Fail2ban is ineffective against distributed brute force -- if someone has a 100k strong botnet, they can try 100k user/pass guesses, and fail2ban won't lift a finger. But stepping back a bit, in the case where you're using keys for auth and have passwords disabled, fail2ban adds nothing.
- jgalt212 9y agotrue, but it's a simple tweak to fail2ban to treat failed login attempts (irrespective of IP address) similar to how it treats failed logins linked to a particular IP address. Of course, the exponential back off would have to be much slower to avoid making the server very susceptible to DDOS attacks. All that being said, yes, ssh keys are the gold standard, but I don't find them to be very portable.