5 ms·
This sounds terrible. I’ve locked myself out of a machine once because I remembered the password wrong. That was annoying. I might have done it without noticing
by pantalaimon 6y ago
This sounds terrible. I’ve locked myself out of a machine once because I remembered the password wrong. That was annoying.
I might have done it without noticing when trying to log into the wrong machine accidentally more than one.
Locking myself out of all machines would be way worse.
- dnautics 6y agoI mean you could also imagine someone somehow seeding your ip address into the crowdsourced fail2ban to maliciously deny you access to your machine for maintenance, or to trigger some sort of opsec regression to get access.
- pas 6y agoSpoofing an IP is not exactly hard, so ... yeah, I'm a bit skeptical of the idea. Yet at the same time I think setting up a long running reputation weighted reputation clearing house would be amazing. (And if nothing else at least something like this could emerge from all the crypto-staking-reputation research. See Polkadot and Ethereum's plans about keeping folks honest with bounties (reverse staking?) for example.)
- Philippe_H 6y agoWell actually Spoofing on a private network is trivial, but in TCP over a public network, it's another story entirely and it's not simple at all. UDP can be easily spoofed though, hence we do not treat reports in the same way so far. Beyond this, there is eventually BGP spoofing, but funny enough, CrowdSec could detect them, provided you have logs. It should be fairly easy to track in terms of behavior.
- dnautics 6y agoYou wouldn't have to spoof. I said seed, not spoof - you could just spin up a bunch of servers, connect it to the crowdsourced security networks, and issue false claims that IP address X has been attempting to break into your network, and suddenly block X from their own servers.
- Philippe_H 6y agoWell we have a consensus system that's quite advanced to avoid poisoning and false positives. To put it short, all members have a Trust rank, only TR1 can publish an IP without counter verification, and only if it doesn't shoot a Canari from our whitelist of IPs. TR1 mean perfect accurate reports for 1+ year. All other TR level can partake but need counter verification from either our own honeypot network or other TR1 peers before being integrated. There is also an AI that will be trained soon to confirm false negatives and extract more complexe patterns.
- pas 6y agoThanks for the details! So basically anyone joining the network for the next year sits in limbo, the network is not capable of catching more "bad IPs" for that year, because any report by new members requires cross-verification by the original nodes/honeypots. This seems pleasantly conservative. Also, is there a way for nodes to lose trust rank? (How will the network find out if a TR1 node is reporting false negatives?)
- Philippe_H 6y agothis is accounted for. By default you have a whitelist containing local lan IP ;)
- remram 6y agoYeah I have 10+ machines with fail2ban configured and 0 of them on my LAN though.
- Philippe_H 6y agowell just whitelist your Public IPs or use a combo of IPset & port knockd. Works fine for me for variable IPs.
- fulafel 6y agoLAN addresses, eh? People do still use internet addressing on our networks despite the consumer CPE vendors increasingly trying to sell you NAT stockholm syndrome :)
- pantalaimon 6y agothe machines i'm ruining fail2ban on are on public networks, not my LAN.
- rhizome 6y agoYou don't use static IPs for managing systems?