4 ms·
They are trying to brute passwords and i found out my fail2ban settings are too low - fail2ban detected them but the ban time wasn't long enough
by Wronnay 6y ago
They are trying to brute passwords and i found out my fail2ban settings are too low - fail2ban detected them but the ban time wasn't long enough
- tmikaeld 6y agoYou can setup fail2ban to permanently add brute-force tries to a proper firewall, like cloudflare. That's how I've set it up. If they try to login 30 times in an 1 hour, then it's definitely not a legit user in any case. When it's blocked on the firewall level, before it reach your server, then your server don't need to handle the request at all.
- zimpenfish 6y ago> If they try to login 30 times in an 1 hour, then it's definitely not a legit user in any case. I have * `exim-usernames` - 10 day ban instantly for anyone trying to login with a specific set of usernames (227 currently banned) * `exim-aggressive` - 4h ban for repeated failures (SSL, EHLO, etc.) (7 currently banned) * `exim-spam` - 4h ban for repeated spam rejections. (0 currently banned) Plus `rspamd` for greylisting, honeypot addresses, etc.