3 ms·

I feel like fail2ban failing open is a good thing. If it fails closed you can't SSH into the server. If it fails open it's just as though you aren't using fail2

by jazoom 8y ago

I feel like fail2ban failing open is a good thing. If it fails closed you can't SSH into the server. If it fails open it's just as though you aren't using fail2ban. Actually, my biggest fear with fail2ban is it failing and locking me out of a remote server. If it indeed always fails open then there's no reason for me not to use it. Though, I don't know how it could be guaranteed to always fail open.

lol768 8y ago
> I feel like fail2ban failing open is a good thing. If it fails closed you can't SSH into the server. If it fails open it's just as though you aren't using fail2ban. But it fails open whilst you think there's a layer of protection there. > Actually, my biggest fear with fail2ban is it failing and locking me out of a remote server Most of these tools will let you whitelist an address - and presumably there's usually a way back in via a serial console/IPMI-KVM interface?
- jazoom 8y ago
  >But it fails open whilst you think there's a layer of protection there. That's pretty easy to test for. >will let you whitelist an address I don't have a static IP address. >usually a way back in via a serial console/IPMI-KVM interface? I haven't been able to do this at my provider when password login is disabled. Maybe I just don't know the way.