5 ms·

Why don't more people use Fail2Ban? https://www.fail2ban.org/wiki/index.php/Main_Page https://www.fail2ban.org/wiki/index.php/Main_Page I avoided running serv

Why don't more people use Fail2Ban? https://www.fail2ban.org/wiki/index.php/Main_Page https://www.fail2ban.org/wiki/index.php/Main_Page I avoided running servers since people are jerks but if I did that would be on my checklist of things to set up if I intended one to stick around long term. People seem to reinvent concepts from long ago for reasons I do not understand.

droopyEyelids 4y ago
Aside from cleaner logs what benefit do you expect from fail2ban?
- zamadatix 4y ago
  It cuts down on the feasibility of generic internet scan + brute force attacks like described in this article. It's not an answer to specialized/focused attacks though cleaner logging may help you notice those.
  - droopyEyelids 4y ago
    If you use brute-forcable passwords it’s better to address that problem directly with password requirements rather than rely on fail2ban
    - zamadatix 4y ago
      It's best to do both as security isn't something delivered by a single solution. After all it's not like protocols such as RDP and SSH have been found to be infallible over the years, they've had side-channels, vulnerabilities detectable by scanning, and other weaknesses regardless whether your password was theoretically impossible to brute force when you made it. You never reach the point "I'm secure" you simply reach the point "adding more security measures costs more than the risk it removes".
      - droopyEyelids 4y ago
        how would fail2ban protect against a SSH or RDP vulnerability?
        zamadatix 4y ago
        Again say there were vulnerabilities due to sidechannels, vulnerabilities related to repetitive scanning with certain options, or weaknesses in the algorithms that allow for collisions much sooner than expected. If you're interesting enough to specifically be targeted by a distributed attack then hopefully you have additional layers while if you're just getting attacked for having an IP exposed on the internet IPS/IDS like fail2ban can be a pretty good first defense. In both cases it's great to feed your SIEM.
johndough 4y ago
I deliberately do not run Fail2Ban so that attackers waste their resources on my server. Before I turned off logging due to GDPR, I got 40M failed login attempts per month.
- Nextgrid 4y ago
  > Before I turned off logging due to GDPR, I got 40M failed login attempts per month. Logging failed login attempts would definitely fall under legitimate interest so you can reenable them. It's not like the attackers would complain anyway.
  - johndough 4y ago
    Logging without consent would be legal due to legitimate interest, but I would also have to comply with "Chapter 3 Rights of the data subject" https://gdpr-info.eu/chapter-3/ https://gdpr-info.eu/chapter-3/ In particular, I do not like article 13 paragraph 1 section (a) because I prefer to stay anonymous. I still receive daily spam from the time I published my contact details on a website 10 years ago. It has also become illegal to embed contact details in an image or hide it behind a captcha due to accessibility. I would risk a 5000 € fine if I did it anyway.
- Terry_Roll 4y ago
  > Before I turned off logging due to GDPR, I got 40M failed login attempts per month I'd love to see one of their Data Subject Access Requests. Dear Victim, Can you wipe my failed login attempts from your servers. Yours, The Hacker!

droopyEyelids 4y ago

Aside from cleaner logs what benefit do you expect from fail2ban?

zamadatix 4y ago
It cuts down on the feasibility of generic internet scan + brute force attacks like described in this article. It's not an answer to specialized/focused attacks though cleaner logging may help you notice those.
- droopyEyelids 4y ago
  If you use brute-forcable passwords it’s better to address that problem directly with password requirements rather than rely on fail2ban
  - zamadatix 4y ago
    It's best to do both as security isn't something delivered by a single solution. After all it's not like protocols such as RDP and SSH have been found to be infallible over the years, they've had side-channels, vulnerabilities detectable by scanning, and other weaknesses regardless whether your password was theoretically impossible to brute force when you made it. You never reach the point "I'm secure" you simply reach the point "adding more security measures costs more than the risk it removes".
    - droopyEyelids 4y ago
      how would fail2ban protect against a SSH or RDP vulnerability?
      - zamadatix 4y ago
        Again say there were vulnerabilities due to sidechannels, vulnerabilities related to repetitive scanning with certain options, or weaknesses in the algorithms that allow for collisions much sooner than expected. If you're interesting enough to specifically be targeted by a distributed attack then hopefully you have additional layers while if you're just getting attacked for having an IP exposed on the internet IPS/IDS like fail2ban can be a pretty good first defense. In both cases it's great to feed your SIEM.

johndough 4y ago

I deliberately do not run Fail2Ban so that attackers waste their resources on my server. Before I turned off logging due to GDPR, I got 40M failed login attempts per month.

Nextgrid 4y ago
> Before I turned off logging due to GDPR, I got 40M failed login attempts per month. Logging failed login attempts would definitely fall under legitimate interest so you can reenable them. It's not like the attackers would complain anyway.
- johndough 4y ago
  Logging without consent would be legal due to legitimate interest, but I would also have to comply with "Chapter 3 Rights of the data subject" https://gdpr-info.eu/chapter-3/ https://gdpr-info.eu/chapter-3/ In particular, I do not like article 13 paragraph 1 section (a) because I prefer to stay anonymous. I still receive daily spam from the time I published my contact details on a website 10 years ago. It has also become illegal to embed contact details in an image or hide it behind a captcha due to accessibility. I would risk a 5000 € fine if I did it anyway.
Terry_Roll 4y ago
> Before I turned off logging due to GDPR, I got 40M failed login attempts per month I'd love to see one of their Data Subject Access Requests. Dear Victim, Can you wipe my failed login attempts from your servers. Yours, The Hacker!