5 ms·

Fairly standard stuff, definitely interesting to see all the IoT credentials attempred. I'd recommend SSHGuard over fail2ban though, I seem to remember the ver

by lol768 9y ago

Fairly standard stuff, definitely interesting to see all the IoT credentials attempred. I'd recommend SSHGuard over fail2ban though, I seem to remember the version of fail2ban in the Debian repos completely choking on IPv6 and failing open which is obviously undesirable.

sametmax 8y ago
Fail2ban failing on ipv6 is strange given it doesn't do anything networky. It just analyses logs and updates iptable.
- iforgotpassword 8y ago
  Calling "iptables" with a v6 address doesn't sound too clever actually.
  - tinix 8y ago
    Installing "iptables" also installs ip6tables. https://linux.die.net/man/8/ip6tables https://linux.die.net/man/8/ip6tables
h1d 8y ago
My experience with SSHGuard was it treated monitoring events (specifically from monit) as failed attempts and blocked further attempts marking the service as unreachable. I'm sure this can be configured but fail2ban does not block such attempts.
jazoom 8y ago
I feel like fail2ban failing open is a good thing. If it fails closed you can't SSH into the server. If it fails open it's just as though you aren't using fail2ban. Actually, my biggest fear with fail2ban is it failing and locking me out of a remote server. If it indeed always fails open then there's no reason for me not to use it. Though, I don't know how it could be guaranteed to always fail open.
- lol768 8y ago
  > I feel like fail2ban failing open is a good thing. If it fails closed you can't SSH into the server. If it fails open it's just as though you aren't using fail2ban. But it fails open whilst you think there's a layer of protection there. > Actually, my biggest fear with fail2ban is it failing and locking me out of a remote server Most of these tools will let you whitelist an address - and presumably there's usually a way back in via a serial console/IPMI-KVM interface?
  - jazoom 8y ago
    >But it fails open whilst you think there's a layer of protection there. That's pretty easy to test for. >will let you whitelist an address I don't have a static IP address. >usually a way back in via a serial console/IPMI-KVM interface? I haven't been able to do this at my provider when password login is disabled. Maybe I just don't know the way.

by lol768 9y ago

sametmax 8y ago

Fail2ban failing on ipv6 is strange given it doesn't do anything networky. It just analyses logs and updates iptable.

iforgotpassword 8y ago
Calling "iptables" with a v6 address doesn't sound too clever actually.
- tinix 8y ago
  Installing "iptables" also installs ip6tables. https://linux.die.net/man/8/ip6tables https://linux.die.net/man/8/ip6tables

h1d 8y ago

My experience with SSHGuard was it treated monitoring events (specifically from monit) as failed attempts and blocked further attempts marking the service as unreachable. I'm sure this can be configured but fail2ban does not block such attempts.

jazoom 8y ago

I feel like fail2ban failing open is a good thing. If it fails closed you can't SSH into the server. If it fails open it's just as though you aren't using fail2ban. Actually, my biggest fear with fail2ban is it failing and locking me out of a remote server. If it indeed always fails open then there's no reason for me not to use it. Though, I don't know how it could be guaranteed to always fail open.

lol768 8y ago
> I feel like fail2ban failing open is a good thing. If it fails closed you can't SSH into the server. If it fails open it's just as though you aren't using fail2ban. But it fails open whilst you think there's a layer of protection there. > Actually, my biggest fear with fail2ban is it failing and locking me out of a remote server Most of these tools will let you whitelist an address - and presumably there's usually a way back in via a serial console/IPMI-KVM interface?
- jazoom 8y ago
  >But it fails open whilst you think there's a layer of protection there. That's pretty easy to test for. >will let you whitelist an address I don't have a static IP address. >usually a way back in via a serial console/IPMI-KVM interface? I haven't been able to do this at my provider when password login is disabled. Maybe I just don't know the way.