3 ms·

How popular is this feature to send emails from fail2ban? I haven't heard about it until now, and I think I'd have a very noisy inbox if my fail2ban setup sent

• marklit 5y ago
  Feeding the fail2ban log to Papertrail or another logging service should give enough visibility. I've seen fail2ban block the IPv4 of a company's headquarters because a new member of staff setup their SSH config wrong and made too many attempts to connect to a production system. In this sort of situation, having federated logs on external infrastructure is a real saviour.
• sseagull 5y ago
  I do it on my personal servers for ssh. I move SSH to a non-standard port, which cuts down a ton. I typically only get a couple emails a year.
  • mrweasel 5y ago
    Serious question: What do you hope to achieve with all that? Fail2Ban has caused more problems for me than it has ever solved, and non-standard ports is confusing if you're a large team. Personally I feel like you're better of just requiring ssh keys, don't install fail2ban and stay on port 22.
    • sseagull 5y ago
      > non-standard ports is confusing if you're a large team I think this is the key part. For me, this is for very small teams or for my personal server, which I need to be able to access with a password from possibly anywhere. For a larger team, I think I agree - emails would be too low of a signal-to-noise ratio. Although I would still use something like fail2ban, but use it just to log to somewhere more appropriate just in case I need it.