8 ms·
fail2ban is a real pet peeve of mine because anyone security conscious enough to deploy this will have likely already mitigated any actual security risks this c
by pandog 3y ago
fail2ban is a real pet peeve of mine because anyone security conscious enough to deploy this will have likely already mitigated any actual security risks this could help with either by using a strong password or public key authentication.
That leaves noise in the logs - which sure, it's nice to reduce, but using an alternative port can help here.
I may sound like a spoilsport - but the fact that there have been a number of security vulnerabilities (https://www.cvedetails.com/vulnerability-list/vendor_id-5567/Fail2ban.html https://www.cvedetails.com/vulnerability-list/vendor_id-5567...) in this project, make it worse than security theatre, it actually increases risk whilst not at all reducing it.
- tptacek 3y agoYes. At this point, fail2ban has become almost a shibboleth for people following security checklists as opposed to reasoning about a coherent threat model. This is a perennial topic on HN, and almost always devolves to some appeal to grooming logs, because of all the authentication errors fail2ban is presumably preventing. Don't use fail2ban. (Don't use passwords, either!) https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=author%3Atptacek%20fail2ban&sort=byPopularity&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
- callwhendone 3y agoI am one of the people to whom you refer. I read about fail2ban in a "Linux Server Bible" e-book around 2010 and have used it on all of my servers since, even though I am careful with my keys and use password-less login.
- wolverine876 3y agoDoes fail2ban have authorization to write firewall rules? That's a high-impact vector of attack, should fail2ban have a vulnerability. Also, does fail2ban store credentials that provide that authorization?
- inferiorhuman 3y agoYes, no.
- dizhn 3y agoIt runs as root.
- meepmorp 3y agoI use fail2ban because I take break in attempts personally, especially when it's some script trying default logins one after another. It's insulting.
- quesera 3y ago> It's insulting Brute force / credential stuffing attacks against ssh are the mosquitos of the Internet. Ubiquitous, annoying, and persistent. But nothing personal.
- meepmorp 3y agoI also take mosquitoes personally, so maybe it's a larger character flaw on my part.
- gnfargbl 3y agoYou have that exactly backwards: if someone is hitting you with a password bruteforce from a single IP address (which is the only threat that fail2ban mitigates) then it is assuredly nothing personal at all. A personal insult, if you are ever unfortunate enough to receive one, will be much more stealthy and neither fail2ban nor any other magical rock will protect you against it.
- CapitalistCartr 3y agoYou don't see any tigers around, do you?
- gog 3y agoUsually they use a big pool of IP addresses, but that doesn't make fail2ban completely useless since they do reuse IPs.
- Cpoll 3y agoIf anything, you're doing them a (miniscule) favor by keeping them from wasting more resources on failed login attempts. If you really hated them, you'd set up a honeypot.
- ozim 3y agoGrooming logs from attempts seems like shibboleth on its own that is indicating junior level or “security enthusiast”. Anyone who manages servers professionally does not read logs anymore and does not care about obvious things like people brute-forcing. Reading ssh logs on your single VPS is security LARPING. Discussing faill2ban as well :)
- totetsu 3y agoAs that gaps of inequality of our winner takes all societies ever widen, anyone just trying to do something for themselves and not for global scale SV company is just meaninglessly role playing.
- ozim 3y agoNot really. Only that reading logs by human or even grepping "manually" is super inefficient where you can make a script that will for instance send you a notification when someone actually logs into your VPS. In world where "login attempts" are basically all day reality reading logs is meaningless. In 2023 no one should be reading logs you should have alerts on events. In 1995 or something if someone was trying to brute-force your user password that was security event to look at and block IP. In 2023 someone brute-forcing is not an event, it is either wrong configuration like not using ssh authentication or not using tools that filter logs automatically and make alerts when something is actually going on.
- ivlad 3y agoWhile I agree fail2ban is a wrong tool to prevent password brute force - better authentication mechanisms should be used instead - it has its uses. For example, it can be used to automatically ban (or alert about) dumb http scanners like gobuster. I am not saying, a determined attacker cannot bypass it, but if it saves me some hassle and raises the bar for them, why should not I do it? More general, some attacker actions, especially during recon, rely on making many attempts to connect, fetch an URL, resolve FQDN, etc., these could be detected and automatically responded to, making attacker’s job harder and providing extra visibility to defenders.
- kasey_junk 3y agoYou shouldn’t use it because fail2ban itself can (and has been) attacked. It doesn’t make the attackers job meaningfully harder but does add complexity to your systems, that complexity is weakness.
- ivlad 3y agoI looked at fail2ban exploits and they are either LPE due to file permissions or command injection in other tools like mailutils. Citation needed for the claim “has been attacked” if you refer to real attacks in the wild.
- wglb 3y agoOne noted upthread https://news.ycombinator.com/item?id=37796588 https://news.ycombinator.com/item?id=37796588
- ivlad 3y agoYeah, that’s command injection in mailutils I mentioned, not in fail2ban itself. Did you see how it’s supposed to be exploited? Did you see a real-life exploitation? While it’s a nice trick, it’s simply not relevant. And the vulnerability before that seems to be 10 years old. I’d say it’s a decent track record.
- callalex 3y agoDoesn’t it help to mitigate DoS type attacks by reducing the amount of CPU that a bad actor can burn?
- discreditable 3y agoYou can do it with ufw limit too
- pluc 3y agoYou can also literally have anything pipe rules into it. Want WordPress auth to result in fail2ban-enforced bans? You can do that. Want cheap rate limiting? You can do that too
- BeefWellington 3y agoThis thread seems pretty full of people dismissing the project based on the idea that it only protects against ssh credential stuffing, and ignoring the other 99.5% of what F2B does.
- pandog 3y agoIf someone is performing a denial of service attack from one I.P. address then this will help. To tptacek's point, you've got to ask yourself is a denial of service attack in your threat model? The reality is most folk set up fail2ban after seeing auth failures in their logs, not service degradation. If you're considering a denial of service attack in your threat model, then I'd probably also consider a DDoS attack and there are likely more effective solutions here (a firewall or CDN). And don't forget you're using some of those precious CPU cycles to parse the auth logs, with python no less :-)
- _vOv_ 3y ago>And don't forget you're using some of those precious CPU cycles to parse the auth logs, with python no less :-) You can ship the log somewhere else, do the fail2ban there and perform the block action in another place up the stack.
- deleted 3y ago[deleted]
- koito17 3y agoYup. I see many resources for self-hosting recommend fail2ban for e.g. SSH. But I always disable password-based SSH logins on all of my computers. The one niche use case I can see for fail2ban is possibly reducing the amount of hits to /wp-login.php and /cgi-bin in your web server (or reverse proxy's) access logs.
- jtriangle 3y ago"Don't use fail2ban because you don't need it if you do XYZ" I'm not so sure that's a good reason to be honest. And if you're worried about CVE's, well, you'll be using handwritten, hand delivered notes before long. Keep your systems patched, keep them tidy, none of this is likely to affect you, fail2ban or not.
- pandog 3y agoTo put it another way - there is no security risk that fail2ban helps with that can't be resolved in another, better, more robust and less risky way.
- zimpenfish 3y agoBut it also helps in reducing the load on your servers when, e.g., instead of 300+ login attempts per minute on your mail ports, you get 20 because the IP gets banned for a day after 2 failures. Or, instead of nginx spending 90% of its time sending out 404s for the various PHP and MySQL holes I do not have installed, it can spend 10% of its time instead. Particularly on my small server, fail2ban is the difference between "usable" and "on the edge of falling over".
- dizhn 3y agoParent says there are more robust solutions to these and there are. Rate limiting is one that has been in use forever for example.
- zimpenfish 3y agoYes, I'm rate-limiting by using fail2ban to drop traffic that I don't want.
- deleted 3y ago[deleted]
- owisd 3y ago
- throw0101c 3y ago> That leaves noise in the logs - which sure, it's nice to reduce, but using an alternative port can help here. No, it cannot. As a sysadmin I do not want to get into user training about telling people about alternative ports and tweaking their CLI habits and any scripts that they have. If you want to further cut down on the log noise get an IPv6 address (and drop IPv4)—good luck to anyone trying to scan a /64 for open ports.
- devwastaken 3y agoYou can scan ipv6 because the addresses aren't arbitrary. Blocks have to be purchased and then ranges within routed.
- ericpauley 3y agoIndividuals usually get a /64. Scanning a truly random address in that range is not feasible.
- deleted 3y ago[deleted]
- t0mas88 3y agoYou can try, but a lot of ISPs assign a big subnet to each user. Mine for example assigns a /48 to each home user fiber connection. Even if I make no effort at all to hide things and just select xxxx:xxxx:xxxx:1:: as the subnet (leaving a factor 65535 options on the table) the devices behind it will randomize the next 64 bits meaning you'll have to scan 18 quintillion (1.8e19) addresses to find one.
- costco 3y agoI read that Shodan was running NTP servers to figure out active IPv6 addresses :)
- soupbowl 3y agoI can cofirm this, I swapped one of my cloud VMs to ipv6 only ssh and after 11 months I never seen a single ip besides mine attempt to login. This was using the default port 22.
- deleted 3y ago[deleted]
- w0z_ 3y ago[flagged]
- stjohnswarts 3y agoYou can point out you think someone is wrong without personal attacks. That's being an adult.
- omginternets 3y agoI'm rather convinced that people reaching for fail2band actually want rate-limiting.
- ivlad 3y agoOften, they do, however configuring it for different applications may be a bigger effort than doing so via fail2ban with minimal log parser tweaking.
- dizhn 3y agoThis is true but on an active server legitimate users getting blocked far exceeds the convince of having cleaner logs in my experience. (Blocks always have to do with saved passwords being used from a nonwhitelisted IP)
- autoexec 3y agoOne nice thing I'll say about fail2ban is that it can fire off reports with decent logs to the networks responsible alerting them to compromised systems and bad actors.
- BeefWellington 3y ago> That leaves noise in the logs - which sure, it's nice to reduce, but using an alternative port can help here. Shifting services to alternate port numbers will stop very stupid scanners but it does not stop the worst offenders IME. Basically it just means you'll only get the really obnoxious sources that try everything ignoring responses. > I may sound like a spoilsport - but the fact that there have been a number of security vulnerabilities (https://www.cvedetails.com/vulnerability-list/vendor_id-5567 https://www.cvedetails.com/vulnerability-list/vendor_id-5567...) in this project, make it worse than security theatre, it actually increases risk whilst not at all reducing it. Given the age of the project and that there's been a whopping NINE vulnerabilities found in its lifetime, this is a great take. By this same logic you better disable OpenSSH everywhere. In the same timeframe as Fail2Ban has has reported vulnerabilities, OpenSSH has had at least 60: https://www.cvedetails.com/vulnerability-list/vendor_id-97/product_id-585/Openbsd-Openssh.html https://www.cvedetails.com/vulnerability-list/vendor_id-97/p... "Worse than security theatre" is quite the statement given they reported and fixed those issues in timely fashions. If you apply the principles of defense in depth, using the network layer to deny access to misbehaving remote hosts is an obvious win on a lot of fronts and hardly qualifies as security theatre anymore than using a network firewall is security theatre.
- dizhn 3y agoIf we limit the use case to a single service, fail2ban is just a log cleaner. What it's detecting is merely the service that you're protecting doing its job properly. Now if you analyze the collected data and do something smarter with it, that's another story.
- rendaw 3y agoIt's not 9 vs 60, it's 9 vs 0 if you don't use it, with no loss in functionality. And GPs point is that it's not defense in depth, the vulnerabilities in Fail2Ban can compromise the security of other layers.
- dizhn 3y agoI agree that almost all use cases of fail2ban are little more than feel-good exercises. Failed login attempts (the noise) are not where bad things happen. What we should be concerned with is if the attempt succeeds but is not from a legitimate user. fail2ban is no help there. Having said that it might be a decent way to collect IPs. At one point I was distributing the collected IPs from VMs and blocking them for the whole network. fail2ban does provide mechanisms to do this.
- BrandoElFollito 3y agoAbsolutely agree. Fail2ban, sooner or later, bans you from your services becasue something in the configuration went wrong. It does not protect against anything serious: you must have proper credentials/MFA or certificates and therefore bots can check as much as they want. There is no protection against DoS either. And I agree about moving the port - I only see a tiny activity in my logs coming from bots when my ssh port moved away. Obviously 443 is there to stay (this is a public service) so I will get whatever comes.