3 ms·
If you use brute-forcable passwords it’s better to address that problem directly with password requirements rather than rely on fail2ban
by droopyEyelids 4y ago
If you use brute-forcable passwords it’s better to address that problem directly with password requirements rather than rely on fail2ban
- zamadatix 4y agoIt's best to do both as security isn't something delivered by a single solution. After all it's not like protocols such as RDP and SSH have been found to be infallible over the years, they've had side-channels, vulnerabilities detectable by scanning, and other weaknesses regardless whether your password was theoretically impossible to brute force when you made it. You never reach the point "I'm secure" you simply reach the point "adding more security measures costs more than the risk it removes".
- droopyEyelids 4y agohow would fail2ban protect against a SSH or RDP vulnerability?
- zamadatix 4y agoAgain say there were vulnerabilities due to sidechannels, vulnerabilities related to repetitive scanning with certain options, or weaknesses in the algorithms that allow for collisions much sooner than expected. If you're interesting enough to specifically be targeted by a distributed attack then hopefully you have additional layers while if you're just getting attacked for having an IP exposed on the internet IPS/IDS like fail2ban can be a pretty good first defense. In both cases it's great to feed your SIEM.