3 ms·

Is fail2ban still a good idea? Any reason it's not mentioned here?

oakwhiz 5y ago
I think that if you follow the recommendation to disable password-based authentication, then fail2ban is downgraded from a near-requirement to a defense-in-depth tactic. It's not nearly as important to restrict the number of retries if asymmetric key-based authentication is used, because there is a much larger keyspace to search through than if passwords were used - assuming that the cryptography works as intended.
tyingq 5y ago
I'm a fan of pam_shield, because it's tied right to the auth part versus tailing log files. And you can trigger whatever action you want. I believe the default is just null routing. https://github.com/jtniehof/pam_shield https://github.com/jtniehof/pam_shield There are other, similar pam modules if this one isn't your cup of tea. There's pam_tally2, and others.
traceroute66 5y ago
Not a good idea for two reasons: 1) The very first configuration change anybody should be making to an SSH server should be disabling password-based authentication. Once you've done that you've rendered fail2ban obsolete, because the only real way in for attackers from that point in is via software security vulnerabilities, and fail2ban can't help you with that, that's your job to keep yourself patched up. 2) In an IPv6 world, fail2ban is pointless. The ranges are so vast.
fulafel 5y ago
It's a way to lock you out if the adversary can source or spoof connections from your usual access network.
- VTimofeenko 5y ago
  Fail2ban has a per-jail ignoreip to not ban specific IPs: https://www.fail2ban.org/wiki/index.php/Whitelist https://www.fail2ban.org/wiki/index.php/Whitelist
  - deleted 5y ago
    [deleted]
BeefWellington 5y ago
As others noted, probably because once you disable password authentication you're cutting out the ability for most bruteforce attempts to work. However, I still think it's valuable for the following reasons: 1) It can slow stupid attackers down, e.g.: those that don't abort a bruteforce attempt when they see password authentication is disabled. Judging by my logs there's lots of those still out there. 2) It keeps the SSH logs less cluttered. 3) You can use it to build a set of hosts to consider blocking permanently.

I think that if you follow the recommendation to disable password-based authentication, then fail2ban is downgraded from a near-requirement to a defense-in-depth tactic. It's not nearly as important to restrict the number of retries if asymmetric key-based authentication is used, because there is a much larger keyspace to search through than if passwords were used - assuming that the cryptography works as intended.

tyingq 5y ago

I'm a fan of pam_shield, because it's tied right to the auth part versus tailing log files. And you can trigger whatever action you want. I believe the default is just null routing. https://github.com/jtniehof/pam_shield https://github.com/jtniehof/pam_shield There are other, similar pam modules if this one isn't your cup of tea. There's pam_tally2, and others.

traceroute66 5y ago

Not a good idea for two reasons: 1) The very first configuration change anybody should be making to an SSH server should be disabling password-based authentication. Once you've done that you've rendered fail2ban obsolete, because the only real way in for attackers from that point in is via software security vulnerabilities, and fail2ban can't help you with that, that's your job to keep yourself patched up. 2) In an IPv6 world, fail2ban is pointless. The ranges are so vast.

fulafel 5y ago

It's a way to lock you out if the adversary can source or spoof connections from your usual access network.

VTimofeenko 5y ago
Fail2ban has a per-jail ignoreip to not ban specific IPs: https://www.fail2ban.org/wiki/index.php/Whitelist https://www.fail2ban.org/wiki/index.php/Whitelist
- deleted 5y ago
  [deleted]

BeefWellington 5y ago

As others noted, probably because once you disable password authentication you're cutting out the ability for most bruteforce attempts to work. However, I still think it's valuable for the following reasons: 1) It can slow stupid attackers down, e.g.: those that don't abort a bruteforce attempt when they see password authentication is disabled. Judging by my logs there's lots of those still out there. 2) It keeps the SSH logs less cluttered. 3) You can use it to build a set of hosts to consider blocking permanently.