3 ms·
Before fail2ban was available my friend and I had our own little script which to this day still works perfectly. If we get 3 failed login attempts with the wron
by X-Istence 15y ago
Before fail2ban was available my friend and I had our own little script which to this day still works perfectly. If we get 3 failed login attempts with the wrong username we ban the IP address, we allow up to 10 failed login attempts for a username that exists.
I've never locked myself out, nor have any of my users. At that point it doesn't matter how fast they are coming either, for the uptime of the script it keeps track of the IP addresses.
One thing we did add was a negative counter, so that if you logged in successfully you basically got a -1 added for your IP address, so if you were to log in successfully 100 times, now you have 110 times to guess your password before being locked out, which honestly hasn't been an issue yet.
I do find it funny watching the log from my script and seeing how many hosts we have blocked. Last time when the uptime on my box was almost 2 years, I had blocked almost 5000 IP addresses. Do note that I block them completely from SSH, and severely rate limit them to any and all other ports.
- funkah 15y agoDoesn't that provide information about which usernames are valid, though? Or does that turn out not to matter?
- tchotchke 15y agoIn reply to funkah's dead comment: > Doesn't that provide information about which usernames are valid, though? Or does that turn out not to matter? Yes it does. A targeted attack would be able to get information out of that. A giant botnet spamming authentication attempts? They apparently don't even notice if their connections are being dropped, never mind the difference between valid and invalid usernames.
- X-Istence 15y agoSure, it provides information, but if you find a username you have 7 more tries left before you get kicked out... so the chance of you actually getting a password that works is tiny.
- WA 15y agoWhat's the idea of the negative counter? Why don't you simply reset to 0 on a successful login?
- X-Istence 15y agoSome users have their home IP's never change, BUT they will forget their password after a month of not having used it. So now they will get their negative count, AND 10 tries to get it right. It has saved the support staff some grief in the past. I've seen a couple of them get to 15 tries and then log in successfully.