3 ms·
Can I ask why you don't trust running fail2ban on 'cloud' based VMs? The defaults for how long it will ban failed ssh attempts are quite sensible, and short eno
by walrus01 5y ago
Can I ask why you don't trust running fail2ban on 'cloud' based VMs? The defaults for how long it will ban failed ssh attempts are quite sensible, and short enough to prevent you from accidentally locking yourself out for a very long period of time (automatic unban time to remove iptables rules).
If nothing else, it serves the useful purpose of stopping the log files from being cluttered up with various botnets' fully automated ssh username/password attempts that are out there, trying to gain access via well known factory default credentials.
- timf 5y agoIt's not really about trust, it's about the hassle of adding and maintaining things (including keeping up with their changelogs and security issues). As for log clutter, my approach comprehensively stops the logs files from being cluttered with failed attempts; that's one of the main reasons I do it.
- walrus01 5y agoThat is a good point but I should also add that fail2ban as a daemon and its default configuration to watch log files for other popular daemons (example: a postfix smtp traffic log) has changed very, very little in the past 5-6 years. It's not very much of a concern in terms of keeping track of configuration changes in major system upgrades.