3 ms·
For pure ssh, this is true, but note that fail2ban can also automatically unblock after a certain amount of time, which is nice when valid users shut themselves
by deng 5y ago
For pure ssh, this is true, but note that fail2ban can also automatically unblock after a certain amount of time, which is nice when valid users shut themselves out by mistake over the weekend... For other services, depending on their type, the false-positive rate will often be way too high.
- tyingq 5y agoPam_shield works well for this, and doesn't have to troll logs to keep counts.
- LinuxBender 5y agoFWIW this can also be done with ipsets. [1] ipset hash tables are quite useful if you are blocking a large number of hosts. The CPU load is much lower than having individual rules for each host blocked. You can set any time limit on a ipset or have no time limit. You can also dynamically insert ip's into ipsets using iptables rules. [1] - https://superuser.com/questions/1412286/time-limited-whitelisting-of-ip-addresses-with-ipset-and-iptables https://superuser.com/questions/1412286/time-limited-whiteli...