3 ms·

On {Free,Net}BSD[1][2] you get Bl*cklistd which is a much better approach than parsing log files. [1] https://man.freebsd.org/cgi/man.cgi?query=blacklistd&sekt

On {Free,Net}BSD[1][2] you get Bl*cklistd which is a much better approach than parsing log files. [1] https://man.freebsd.org/cgi/man.cgi?query=blacklistd&sektion=8&format=html https://man.freebsd.org/cgi/man.cgi?query=blacklistd&sektion... [2] https://man.netbsd.org/blocklistd.8 https://man.netbsd.org/blocklistd.8

loeg 3y ago
The primary author died in 2019. Is it still being worked on? I agree it seems like a superior approach.
sedatk 3y ago
Isn't that specifically DoS oriented? Doesn't seem to cover fail2ban's use case.
- BSDobelix 3y ago
  The difference is blacklistd is just a api and a database for telling the firewall to block ip's. The decision to inform blacklistd is on the application side, and not a scanner that checks the log's produced by that application. And yes, DoS is a very good example, if your application writes so much log's (during a attack) and fail2ban has to analyze them during that, then machine could very well DoS itself, the blacklistd approach is much simpler and straightforward BUT (and that's a big one) the applications has to support it.
  - sedatk 3y ago
    Thanks!
- plz-remove-card 3y ago
  No, once an IP had failed authentication a configured number of times, the IP is blocked (for a configurable amount of time.)
  - sedatk 3y ago
    What does it mean for an IP to fail “authentication” in that context? As I understand, they only check for failed connection attempts, not failed authentications?
    - plz-remove-card 3y ago
      The first thing it was integrated into was sshd, there's a small patch in sshd that sends a notification to the blacklist daemon when a connection has failed authentication.
      - sedatk 3y ago
        Got it, thanks. It was surprisingly hard to find details about it except for the man page.
        plz-remove-card 3y ago
        If you're interested in an overview, I'd recommend this vid from the author: https://www.youtube.com/watch?v=fuuf8G28mjs&t=74s https://www.youtube.com/watch?v=fuuf8G28mjs&t=74s
        sedatk 3y ago
        Thanks for that too!

loeg 3y ago

The primary author died in 2019. Is it still being worked on? I agree it seems like a superior approach.

sedatk 3y ago

Isn't that specifically DoS oriented? Doesn't seem to cover fail2ban's use case.

BSDobelix 3y ago
The difference is blacklistd is just a api and a database for telling the firewall to block ip's. The decision to inform blacklistd is on the application side, and not a scanner that checks the log's produced by that application. And yes, DoS is a very good example, if your application writes so much log's (during a attack) and fail2ban has to analyze them during that, then machine could very well DoS itself, the blacklistd approach is much simpler and straightforward BUT (and that's a big one) the applications has to support it.
- sedatk 3y ago
  Thanks!
plz-remove-card 3y ago
No, once an IP had failed authentication a configured number of times, the IP is blocked (for a configurable amount of time.)
- sedatk 3y ago
  What does it mean for an IP to fail “authentication” in that context? As I understand, they only check for failed connection attempts, not failed authentications?
  - plz-remove-card 3y ago
    The first thing it was integrated into was sshd, there's a small patch in sshd that sends a notification to the blacklist daemon when a connection has failed authentication.
    - sedatk 3y ago
      Got it, thanks. It was surprisingly hard to find details about it except for the man page.
      - plz-remove-card 3y ago
        If you're interested in an overview, I'd recommend this vid from the author: https://www.youtube.com/watch?v=fuuf8G28mjs&t=74s https://www.youtube.com/watch?v=fuuf8G28mjs&t=74s
        sedatk 3y ago
        Thanks for that too!