4 ms·

> This. I really do not understand why people use fail2ban when the threat is somewhere else. Fail2ban keeps my log short enough that I can review them daily,

> This. I really do not understand why people use fail2ban when the threat is somewhere else. Fail2ban keeps my log short enough that I can review them daily, I don't have to sift through thousands of login attempt. > It won't stop a ddos but will certainly, at some point, prevent you from logging in. Yup, losing my key and having no password access will do that.

jrockway 3y ago
I'm not sure manual log scanning is all that interesting. You probably want to produce a list of successful logins and review that regularly.
- wkat4242 3y ago
  If an attacker manages a succesful login you've already lost. Better to catch them in the act while they're scoping you out.
  - jrockway 3y ago
    If your SSH key leaks you're not going to have a warning. All you'll see is a login from yourself that you don't remember. I am pretty sure we turned off password authentication like 10 posts up this thread.
    - elesiuta 3y ago
      This is why I require both a private key and a password. I have fail2ban configured to block IPs with invalid private keys after a couple attempts, and if the key is valid to email me and rate limit invalid password attempts. This gives a more than sufficient warning if my key leaks which is already very unlikely, and this just makes it much more unlikely for both to be compromised, and only took an extra 5 minutes to configure.
      - phanimahesh 3y ago
        How do you configure emails on successful logins? Can you share your config, sufficiently anonymized?
        elesiuta 3y ago
        I created a jail for fail2ban with logpath = /var/log/auth.log and for the filter I use failregex = .*Connection closed by authenticating user [a-z_]([a-z0-9_-]{0,31}|[a-z0-9_-]{0,30}\$) <HOST> port [0-9]* \[preauth\] and the emails are just cron with a python script that checks /var/log/fail2ban.log for any new Found|Ban|Unban IPs and sends them using smtplib If you like I can share the full config files but the rest isn't too interesting nor different from what is here https://www.fail2ban.org/wiki/index.php/MANUAL_0_8#Jails https://www.fail2ban.org/wiki/index.php/MANUAL_0_8#Jails
BrandoElFollito 3y ago
I move my port to an uninteresting place and it considerably reduces the amount of logs. If this was a nuisance I would filter out the messages > Yup, losing my key and having no password access will do that. You can also lose your password. Or forget it if you know it by heart. But in any case you can use a password instead of a key - it just needs to be good enough (= long and not in cracking dictionaries)

jrockway 3y ago

I'm not sure manual log scanning is all that interesting. You probably want to produce a list of successful logins and review that regularly.

wkat4242 3y ago
If an attacker manages a succesful login you've already lost. Better to catch them in the act while they're scoping you out.
- jrockway 3y ago
  If your SSH key leaks you're not going to have a warning. All you'll see is a login from yourself that you don't remember. I am pretty sure we turned off password authentication like 10 posts up this thread.
  - elesiuta 3y ago
    This is why I require both a private key and a password. I have fail2ban configured to block IPs with invalid private keys after a couple attempts, and if the key is valid to email me and rate limit invalid password attempts. This gives a more than sufficient warning if my key leaks which is already very unlikely, and this just makes it much more unlikely for both to be compromised, and only took an extra 5 minutes to configure.
    - phanimahesh 3y ago
      How do you configure emails on successful logins? Can you share your config, sufficiently anonymized?
      - elesiuta 3y ago
        I created a jail for fail2ban with logpath = /var/log/auth.log and for the filter I use failregex = .*Connection closed by authenticating user [a-z_]([a-z0-9_-]{0,31}|[a-z0-9_-]{0,30}\$) <HOST> port [0-9]* \[preauth\] and the emails are just cron with a python script that checks /var/log/fail2ban.log for any new Found|Ban|Unban IPs and sends them using smtplib If you like I can share the full config files but the rest isn't too interesting nor different from what is here https://www.fail2ban.org/wiki/index.php/MANUAL_0_8#Jails https://www.fail2ban.org/wiki/index.php/MANUAL_0_8#Jails

BrandoElFollito 3y ago

I move my port to an uninteresting place and it considerably reduces the amount of logs. If this was a nuisance I would filter out the messages > Yup, losing my key and having no password access will do that. You can also lose your password. Or forget it if you know it by heart. But in any case you can use a password instead of a key - it just needs to be good enough (= long and not in cracking dictionaries)