3 ms·
Isn't that specifically DoS oriented? Doesn't seem to cover fail2ban's use case.
by sedatk 3y ago
Isn't that specifically DoS oriented? Doesn't seem to cover fail2ban's use case.
- BSDobelix 3y agoThe difference is blacklistd is just a api and a database for telling the firewall to block ip's. The decision to inform blacklistd is on the application side, and not a scanner that checks the log's produced by that application. And yes, DoS is a very good example, if your application writes so much log's (during a attack) and fail2ban has to analyze them during that, then machine could very well DoS itself, the blacklistd approach is much simpler and straightforward BUT (and that's a big one) the applications has to support it.
- sedatk 3y agoThanks!
- plz-remove-card 3y agoNo, once an IP had failed authentication a configured number of times, the IP is blocked (for a configurable amount of time.)
- sedatk 3y agoWhat does it mean for an IP to fail “authentication” in that context? As I understand, they only check for failed connection attempts, not failed authentications?
- plz-remove-card 3y agoThe first thing it was integrated into was sshd, there's a small patch in sshd that sends a notification to the blacklist daemon when a connection has failed authentication.
- sedatk 3y agoGot it, thanks. It was surprisingly hard to find details about it except for the man page.
- plz-remove-card 3y agoIf you're interested in an overview, I'd recommend this vid from the author: https://www.youtube.com/watch?v=fuuf8G28mjs&t=74s https://www.youtube.com/watch?v=fuuf8G28mjs&t=74s
- sedatk 3y agoThanks for that too!