3 ms·

if your systems have any of these easily targeted vulnerabilities exposed, fail2ban won't save you

velcrovan 3y ago
fair point, the main reason I use fail2ban is to limit traffic from malicious activity rather than letting the attempts run rampant and unchecked.
- creeble 3y ago
  If it makes you feel good, do it. It can also cut down on log noise a bit, for when you’re really looking for something. But in general, I’ve given up on caring about the routine “attacks” listed in all the logs. If you have good security, they don’t matter. And if you don’t, they don’t matter either.
- geraldhh 3y ago
  caring for pointless attacks is more work and bears more risk
jbverschoor 3y ago
In addition, you can have nginx filters to check for simple patterns (php on a non-php site? -> instant ban). Too many 404s? -> instant ban.
- BLKNSLVR 3y ago
  I have recently started using my own sledgehammer-subtle approach of detecting (what I refer to as) Uninvited Activity on any port not offering a service, and straight-up banning the source IP (indefinitely at the moment) from accessing any actual service ports. Over the few months I've had it running I've needed to progressively create failsafes for IP addresses that I know are trustworthy so I don't lock myself out. I've also started tiering the importance of blocking based on different sets of ports which are being probed. I've also discovered that there's a significant amount of Uninvited Activity coming from "security" companies in their pro-active scanning of the entire IPv4 space - which I don't trust at all and ban with prejudice. It's messy and I need to update and add many explanations, but it's on Github if anyone wants a laugh: https://github.com/UninvitedActivity/UninvitedActivity https://github.com/UninvitedActivity/UninvitedActivity (I'm aware of various limitations and footguns inherent in this un-subtle approach but, as another commenter elsewhere alluded to, "it makes me feel better". I also think that a fair bit of processing volume can be taken off IDS' if a heap of "known garbage" traffic is blocked prior - it's all about tiers).

fair point, the main reason I use fail2ban is to limit traffic from malicious activity rather than letting the attempts run rampant and unchecked.

creeble 3y ago
If it makes you feel good, do it. It can also cut down on log noise a bit, for when you’re really looking for something. But in general, I’ve given up on caring about the routine “attacks” listed in all the logs. If you have good security, they don’t matter. And if you don’t, they don’t matter either.
geraldhh 3y ago
caring for pointless attacks is more work and bears more risk

jbverschoor 3y ago

In addition, you can have nginx filters to check for simple patterns (php on a non-php site? -> instant ban). Too many 404s? -> instant ban.

BLKNSLVR 3y ago
I have recently started using my own sledgehammer-subtle approach of detecting (what I refer to as) Uninvited Activity on any port not offering a service, and straight-up banning the source IP (indefinitely at the moment) from accessing any actual service ports. Over the few months I've had it running I've needed to progressively create failsafes for IP addresses that I know are trustworthy so I don't lock myself out. I've also started tiering the importance of blocking based on different sets of ports which are being probed. I've also discovered that there's a significant amount of Uninvited Activity coming from "security" companies in their pro-active scanning of the entire IPv4 space - which I don't trust at all and ban with prejudice. It's messy and I need to update and add many explanations, but it's on Github if anyone wants a laugh: https://github.com/UninvitedActivity/UninvitedActivity https://github.com/UninvitedActivity/UninvitedActivity (I'm aware of various limitations and footguns inherent in this un-subtle approach but, as another commenter elsewhere alluded to, "it makes me feel better". I also think that a fair bit of processing volume can be taken off IDS' if a heap of "known garbage" traffic is blocked prior - it's all about tiers).