3 ms·
Aside from cleaner logs what benefit do you expect from fail2ban?
by droopyEyelids 4y ago
Aside from cleaner logs what benefit do you expect from fail2ban?
- zamadatix 4y agoIt cuts down on the feasibility of generic internet scan + brute force attacks like described in this article. It's not an answer to specialized/focused attacks though cleaner logging may help you notice those.
- droopyEyelids 4y agoIf you use brute-forcable passwords it’s better to address that problem directly with password requirements rather than rely on fail2ban
- zamadatix 4y agoIt's best to do both as security isn't something delivered by a single solution. After all it's not like protocols such as RDP and SSH have been found to be infallible over the years, they've had side-channels, vulnerabilities detectable by scanning, and other weaknesses regardless whether your password was theoretically impossible to brute force when you made it. You never reach the point "I'm secure" you simply reach the point "adding more security measures costs more than the risk it removes".
- droopyEyelids 4y agohow would fail2ban protect against a SSH or RDP vulnerability?
- zamadatix 4y agoAgain say there were vulnerabilities due to sidechannels, vulnerabilities related to repetitive scanning with certain options, or weaknesses in the algorithms that allow for collisions much sooner than expected. If you're interesting enough to specifically be targeted by a distributed attack then hopefully you have additional layers while if you're just getting attacked for having an IP exposed on the internet IPS/IDS like fail2ban can be a pretty good first defense. In both cases it's great to feed your SIEM.