3 ms·
I am also not him. Fail2ban is ineffective against distributed brute force -- if someone has a 100k strong botnet, they can try 100k user/pass guesses, and fai
by kardos 9y ago
I am also not him.
Fail2ban is ineffective against distributed brute force -- if someone has a 100k strong botnet, they can try 100k user/pass guesses, and fail2ban won't lift a finger.
But stepping back a bit, in the case where you're using keys for auth and have passwords disabled, fail2ban adds nothing.
- jgalt212 9y agotrue, but it's a simple tweak to fail2ban to treat failed login attempts (irrespective of IP address) similar to how it treats failed logins linked to a particular IP address. Of course, the exponential back off would have to be much slower to avoid making the server very susceptible to DDOS attacks. All that being said, yes, ssh keys are the gold standard, but I don't find them to be very portable.
- tptacek 9y agoUsing anything but SSH keys is engineering malpractice.
- jgalt212 9y agoperhaps, but have you ever tried to get non-technical or semi-technical staff to master ssh code key generation and use?
- kasey_junk 9y agoAllowing non-technical or semi-technical staff ssh access to computers is engineering malpractice.
- 0xdeadbeefbabe 9y agoEngineering is engineering malpractice too.