4 ms·

is there a chance of forming some kind of a community fail2ban blocklist? I guess trusting the contributors and admins is the hard part here and that’s why spam

is there a chance of forming some kind of a community fail2ban blocklist? I guess trusting the contributors and admins is the hard part here and that’s why spam lists are a double edged sword?

NavinF 4y ago
Well that and sane people just disable password auth. fail2ban is a 90s sysadmin solution to a nonexistent problem.
- nousermane 4y ago
  IP reputation is a problem wider then just SSH password brute-forcing - see HTTP(S) brute-force example elsewhere in this thread.
- seized 4y ago
  Fail2Ban can do more than SSH. Any log that can be parsed and has a useful remote IP can work. I have it scanning my Ubiquiti NVR logs, I modified Tomcat to log the remote IP from my reverse proxy. If anyone tries to log into my NVR three times then Fail2Ban adds the IP to a permanent blocklist on my OpnSense firewall and then HAProxy kills the TCP connection. They can't even ping after that.
gruez 4y ago
That's basically what DNS RBLs are.
somat 4y ago
peter hessler had an interesting system where the blacklists were distributed via bgp. It sounds weird at first but the more I think about it the more it makes sense. delivering routes(or in this case anti routes) is bgp's core mission. Unfortunately he shut down his bgp spam route sender last year. http://www.bgp-spamd.net/ http://www.bgp-spamd.net/
pabs3 4y ago
The CrowdSec folks have something similar to that: https://crowdsec.net/ https://crowdsec.net/ https://github.com/crowdsecurity/crowdsec https://github.com/crowdsecurity/crowdsec
klausagnoletti 4y ago
As someone else mentions, CrowdSec can do just that. It's FOSS and can act as a modern Fail2Ban replacement that can detect all sorts of attacks - in this case ssh bruteforce/slow brute force attacks - and shares very basic information about those attacks (source ip, timestamp, which attack) with everyone else. So in that way everybody using CrowdSec are helping each other out. More information at https://crowdsec.net https://crowdsec.net. Disclaimer: I am head of community at CrowdSec so feel free to ask me any questions you may have here or join our Discord at https://dicord.gg/crowdsec https://dicord.gg/crowdsec.
- gingerlime 4y ago
  Thank you! super cool! how do you solve the trust issue? (e.g. someone reporting their competitor ips as attackers, or whitelisting false positives/appeals)

is there a chance of forming some kind of a community fail2ban blocklist? I guess trusting the contributors and admins is the hard part here and that’s why spam lists are a double edged sword?

NavinF 4y ago

Well that and sane people just disable password auth. fail2ban is a 90s sysadmin solution to a nonexistent problem.

nousermane 4y ago
IP reputation is a problem wider then just SSH password brute-forcing - see HTTP(S) brute-force example elsewhere in this thread.
seized 4y ago
Fail2Ban can do more than SSH. Any log that can be parsed and has a useful remote IP can work. I have it scanning my Ubiquiti NVR logs, I modified Tomcat to log the remote IP from my reverse proxy. If anyone tries to log into my NVR three times then Fail2Ban adds the IP to a permanent blocklist on my OpnSense firewall and then HAProxy kills the TCP connection. They can't even ping after that.

gruez 4y ago

That's basically what DNS RBLs are.

somat 4y ago

peter hessler had an interesting system where the blacklists were distributed via bgp. It sounds weird at first but the more I think about it the more it makes sense. delivering routes(or in this case anti routes) is bgp's core mission. Unfortunately he shut down his bgp spam route sender last year. http://www.bgp-spamd.net/ http://www.bgp-spamd.net/

pabs3 4y ago

The CrowdSec folks have something similar to that: https://crowdsec.net/ https://crowdsec.net/ https://github.com/crowdsecurity/crowdsec https://github.com/crowdsecurity/crowdsec

klausagnoletti 4y ago

As someone else mentions, CrowdSec can do just that. It's FOSS and can act as a modern Fail2Ban replacement that can detect all sorts of attacks - in this case ssh bruteforce/slow brute force attacks - and shares very basic information about those attacks (source ip, timestamp, which attack) with everyone else. So in that way everybody using CrowdSec are helping each other out. More information at https://crowdsec.net https://crowdsec.net. Disclaimer: I am head of community at CrowdSec so feel free to ask me any questions you may have here or join our Discord at https://dicord.gg/crowdsec https://dicord.gg/crowdsec.

gingerlime 4y ago
Thank you! super cool! how do you solve the trust issue? (e.g. someone reporting their competitor ips as attackers, or whitelisting false positives/appeals)