10 ms·
Fail2Ban
- IronWolve 3y agoWorks great, been using it for a long time to stop bots crawling sites. Also on hosts with open ports, like ssh that you cant whitelist.
- qwertox 3y agoCan this be a dynamic whitelist or is there an API to whitelist/de-whitelist specific IPs?
- davesmylie 3y agoIt's a dynamic blacklist. Any abusive IPs get banned for x minutes. You can white list specific IPs though
- qwertox 3y ago> You can white list specific IPs though This is what I mean, if this list can be dynamic or modified at runtime with an API.
- throitallaway 3y agoWhy was this posted? It's a great project that's widely known and pretty much ancient in terms of OSS projects.
- TheCoreh 3y agoA lot of people might not know about it yet, and genuinely find it useful https://xkcd.com/1053/ https://xkcd.com/1053/
- deleted 3y ago[deleted]
- mullingitover 3y agoI would guess the subtext here is related to the 23andme breach. The problem with fail2ban is that an attacker who has a botnet of significant size at their disposal won't even be slowed down. Not saying it's worthless, but it's not a silver bullet.
- seanp2k2 3y agoNot saying fail2ban is in any way state-of-the-art security or even best-practice at this point, but if they're burning an IP after a few bad attempts, that's going to be more effective than letting them try tens of thousands per IP, no? Security in layers of course, so even a few [dozen, hundred] failed SSH attempts should probably raise an alarm or put things into an elevated security mode automatically...but also don't leave SSH open to the public, especially not on :22.
- mullingitover 3y ago> but also don't leave SSH open to the public, especially not on :22 100%. These days, at least if you're working out of a cloud provider, there's no excuse for exposing SSH to the world on any port. AWS/GCP/Azure all have different tools to allow you to run bastion-type services without internet-facing SSH.
- wds 3y agoI like occasional discussions on these things. People sharing tips, experiences, pitfalls, etc. It gets everyone in one place at around the same time to do it, like a small digital convention.
- kevingadd 3y agoBe careful not to ban yourself :) had to use linode emergency shell once after misconfigured fail2ban blocked my ip
- eco 3y agoThat's just a rite of passage we must all do.
- akerl_ 3y agoThe pro tip is to just not use it for SSH
- PUSH_AX 3y agoTo expand on this, don't use it because a good approach is to disable password authentication on SSH and use keys instead. If for some reason you still needed password auth enabled I'd be inclined to still use f2b.
- ljm 3y agoEvery time I spin up a box by hand (which isn't often), I'll set up a sudo user with my SSH key, then drop out of the root shell and log back in as the new user. Only then will I disable root login and password auth over SSH and start setting up fail2ban and the like. If I lose access by, say, switching to a new computer and losing my SSH key, then I'm more or less dead in the water. But it's a small price to pay and 1password supports SSH keys first-class now.
- jsisto 3y agoShoutout to my favorite docker image that leverages fail2ban https://github.com/linuxserver/docker-swag https://github.com/linuxserver/docker-swag
- gv83 3y agoThe best friend of the small business LAMP specialized dev! Those mass scanners really love wordpress
- SlavikCA 3y agoI really wanted fail2ban for my windows RDP. I'm using non-standard RDP port and still getting 10,000+ brute-forcing requests per day. Found this alternative: https://github.com/DigitalRuby/IPBan https://github.com/DigitalRuby/IPBan
- mobilio 3y agoBoth are useful: https://github.com/EvanAnderson/ts_block https://github.com/EvanAnderson/ts_block https://github.com/Zeziroth/Cancer2Ban https://github.com/Zeziroth/Cancer2Ban
- EvanAnderson 3y agoI made ts_block. It solved a particular problem I had at a particular time. Nobody should be doing RDP across the Internet w/o a VPN but, apparently, people still do it. Shockingly it still works fine on Server 2022.
- mobilio 3y agoTHANK YOU! I have friends of mine that slowly migrated to ZeroTier for RDP.
- Phil_Latio 3y agoWhat port do you use? Obviously you have to use one which is not common and not in the list of scanned ports of services like shodan or censys.
- SlavikCA 3y agoI have RDP on port 8443. On another host I tried port 443, hoping to disguise it to appear like SSL. No any difference. Also, there are services, which already publishing all my (and yours) open ports. Here is the report for my IP: https://search.censys.io/hosts/104.63.172.143 https://search.censys.io/hosts/104.63.172.143 (It's public anyway)
- chunk_waffle 3y agoFor SSH I prefer blocklistd[0], which sadly is only available on FreeBSD and NetBSD AFAIK, it's a much simpler approach though requires a small patch to any daemons that want support. [0] https://youtu.be/fuuf8G28mjs?si=UhuRVndacryMim_a https://youtu.be/fuuf8G28mjs?si=UhuRVndacryMim_a
- keep_reading 3y agoI came to mention this. I was impressed when it was announced and disheartened to see it ignored
- LinuxBender 3y agoAnother couple fun things for SSH are iptables string module [1] and just adding a really long version addendum. [2] Silly examples but the bots get confused. I admit these are not efficient rules. Try it out on that domain. Send some SSH bots my way, I honestly have no idea what it looks like on the bot-end-of-things. I would estimate about 95% of bots are libssh. About 4% are Go and the rest are an odd mix. That string can be spoofed but I think most people are too lazy. [1] - https://bender.ohblog.net/temp/ipt.txt https://bender.ohblog.net/temp/ipt.txt [2] - https://bender.ohblog.net/temp/vers.txt https://bender.ohblog.net/temp/vers.txt
- LinuxBender 3y agoI forgot to mention, if the IPtables examples are useful they can make things ever more quiet if instead of "-j DROP" one uses "-j SET options" to add to an ipset, then use that same ipset in an outbound rule to tcp-reset the openssh socket to free up memory faster. Not really a big deal unless one gets flooded but probably useful to someone some day. Maybe I will do a little write-up on this.
- dboreham 3y agoProbably needs a date, since this tool is extremely old?
- stjohnswarts 3y agols and cat and ssh are also old.
- rakkhi 3y agoDon’t ban hosts or any service account automatically. Use conditional accesss, mga for hosts with credentials + IP or client cert. Auto raise a snow ticket for the support team and an alert in your SIEM for your Soc. If you want more detail I’ll put my blog in my profile.
- pandog 3y agofail2ban is a real pet peeve of mine because anyone security conscious enough to deploy this will have likely already mitigated any actual security risks this could help with either by using a strong password or public key authentication. That leaves noise in the logs - which sure, it's nice to reduce, but using an alternative port can help here. I may sound like a spoilsport - but the fact that there have been a number of security vulnerabilities (https://www.cvedetails.com/vulnerability-list/vendor_id-5567/Fail2ban.html https://www.cvedetails.com/vulnerability-list/vendor_id-5567...) in this project, make it worse than security theatre, it actually increases risk whilst not at all reducing it.
- tptacek 3y agoYes. At this point, fail2ban has become almost a shibboleth for people following security checklists as opposed to reasoning about a coherent threat model. This is a perennial topic on HN, and almost always devolves to some appeal to grooming logs, because of all the authentication errors fail2ban is presumably preventing. Don't use fail2ban. (Don't use passwords, either!) https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=author%3Atptacek%20fail2ban&sort=byPopularity&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
- callwhendone 3y agoI am one of the people to whom you refer. I read about fail2ban in a "Linux Server Bible" e-book around 2010 and have used it on all of my servers since, even though I am careful with my keys and use password-less login.
- wolverine876 3y agoDoes fail2ban have authorization to write firewall rules? That's a high-impact vector of attack, should fail2ban have a vulnerability. Also, does fail2ban store credentials that provide that authorization?
- inferiorhuman 3y ago
- dpcx 3y agoI wrote about using fail2ban with postfix[0] almost 15 years ago for blocking IPs that were sending to unknown email addresses on my server. It was a godsend for blocking tons of spam back then. [0]: https://www.dp.cx/blog/postfix---fail2ban---win.html https://www.dp.cx/blog/postfix---fail2ban---win.html
- JAlexoid 3y agoI personally would rather recommend a whitelisting functionality, using a trusted third party. I wonder if SSO services can provide IPs of successfully authenticated against their services users.
- seanp2k2 3y agoJump hosts are a well-tested and widely-deployed pattern already that basically do the same thing without the downside of lockout problems from connecting from somewhere new.
- JAlexoid 3y agoI was recently thinking on a way to open up my Jellyfin Media Server, so I can stream music from my personal collection. Jumpbox would easily incur a lot of traffic costs... due to all of the media being very large(many users of jellyfin suggest that). I also would like to allow friends access to my library, without them having to connect to my VPN. Having had a very bad experience with getting my home network once DDoSed and once hacked - I am at a stage where a reliable third party source, that can tell me what IP to whitelist, is the only reasonable solution I can come up with. (I know it's not a common use case, but it is my use case)
- miohtama 3y agoThe first thing you need to do on any new Linux server installation: sudo apt install fail2ban # Choose your flavour And you get rid of most pesky SSH knocking traffic and credential stuffing attacks.
- seanp2k2 3y agoChanging the port to anything other than 22 does this as well.
- zimpenfish 3y agoChanging the port reduces the traffic, yep, but definitely doesn't get rid of it - all my servers use non-standard ports for ssh and there's still ~10 login attempts a minute.
- dizhn 3y ago2244 ? I used to get almost no tries on 2244 which is kind of an obvious choice. Nowadays I have wireguard and no ssh ports exposed as they run on private IPs.
- dang 3y agoRelated. Others? Brute.Fail: Watch brute force attacks fail in real time - https://news.ycombinator.com/item?id=36169954 https://news.ycombinator.com/item?id=36169954 - June 2023 (259 comments) Ask HN: How to protect against endless SSH login attempts to my server? - https://news.ycombinator.com/item?id=34077205 https://news.ycombinator.com/item?id=34077205 - Dec 2022 (27 comments)
- SushiHippie 3y agoCurrently on the front page: https://news.ycombinator.com/item?id=37799438 https://news.ycombinator.com/item?id=37799438
- Kiro 3y agoSince IP addresses are PII, how can I use this and still respect GDPR? It's not like I can use consent for processing.
- worksonmine 3y agoSince you're also obligated to secure said data storing the IPs from brute force attempts is not only fine but almost a requirement. You're not making the connection to any individual and the use-case is legitimate.
- chownie 3y agoYou don't need consent because this information is strictly required for a legitimate business purpose (ensuring machine security) This is explicitly made an example here: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/legitimate-interests/when-can-we-rely-on-legitimate-interests/#purpose_legitimate https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...
- M2Ys4U 3y agoFirstly, the GDPR doesn't care about PII - that's an American legal term and the GDPR is an EU law. It deals with processing personal data, and the two are not the same (although there is overlap, with PD having a more expansive definition). Secondly, consent is only one of six legal bases for processing personal data. The other five are that: - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; - processing is necessary for compliance with a legal obligation to which the controller is subject; - processing is necessary in order to protect the vital interests of the data subject or of another natural person; - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; and - processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. The last of those - legitimate interests - is clearly appropriate, the rights of the data subjects (i.e. the IP addresses' users) don't override the legitimate interests of securing one's machines, especially given the limited processing performed by tools like Fail2Ban.
- CtrlCthenV 3y agoI was first exposed to fail2ban by some PBX server suite I was setting up. Totally cannot remember the name of it, but it checked to see if the fail2ban service was running. If it was not the PBX service would not start and throw a are you insane error message. Saved a lot of new kids like me at the time who were just fooling around I bet.
- HaZeust 3y agoSame, VICIdial introduced me to it!
- steelframe 3y agoAt a former employer I hooked up a random Debian box to the corp network. Of course I ran fail2ban, in addition to a host of other lockdown measures. Without fail every morning at the same time some random corp scanner would start hammering on the ports, and fail2ban would kick in and block the scanner. After the default expiration time the rules blocking the scanner would expire, and it would happen again the next morning. This probably continued going on for several weeks or perhaps even months after I left the company.
- BrandoElFollito 3y agoYou would get seriously yelled at by my team if you did this in my company. The corporate scanner are not there for fun or because security loves to do scans. They are there exactly because they are random wannabe sysadmins who will plug in a box that ends up compromised. A scanner may help to locate it and possibly warn about the issue. And only maybe. Do not make life difficult for people who already have they hands full of constant vulnerabilities, fighting corporate crap and being the bad guys because they audit stuff. We have a life too.
- deleted 3y ago[deleted]
- computerfriend 3y agoYou can achieve something similar with just iptables / nftables that doesn't involve parsing logs. https://blog.bigdinosaur.org/securing-ssh-with-iptables/ https://blog.bigdinosaur.org/securing-ssh-with-iptables/
- quibono 3y agoThere is a way to use fail2ban together with nginx's rate limiting to implement a temporary ban on addresses that are repeatedly abusive. As far as I know this is one of the least friction ways to achieve that. The limit_req directive works by dropping the responses that exceed the limit but does nothing more than that. Fail2ban can be scanning the nginx log files for instances of someone exceeding the limit, and add them to e.g. a Redis set. You can then use a Lua plugin to track incoming request addresses and check whether they belong to the "banned" set (then you can drop the connection fully).