4 ms·

Why are they not using fail2ban?

by udev4096 3y ago

csdreamer7 3y ago
Where did they say they did not use fail2ban?
- udev4096 3y ago
  I don't see any mention of it in the post
rlpb 3y ago
Here's a good list of reasons: https://www.opencve.io/cve?vendor=fail2ban https://www.opencve.io/cve?vendor=fail2ban Parsing log files not intended to be read by automation (eg. questionable or nonexistent escaping) to then take actions as root is with great remote injection vector is not a good idea.
- 15457345234 3y ago
  That's a very very small list of vulnerabilities for such a widely used piece of software. Using fail2ban with SSH is very widely done and is thoroughly recommended. It increases security and is objectively a good idea.
  - rlpb 3y ago
    > That's a very very small list of vulnerabilities for such a widely used piece of software. They are schoolboy errors in a relatively trivial piece of software that very well demonstrate the fundamental security flaw in its design. > is thoroughly recommended Recommended by whom? The Internet, or prominent experts in the field?
    - 15457345234 3y ago
      > They are schoolboy errors in a relatively trivial piece of software that very well demonstrate the fundamental security flaw in its design. I read through the CVEs and they're not 'schoolboy errors' at all - in fact, the first one doesn't even refer to fail2ban itself but to a program being called by fail2ban. There's no fundamental security flaw in its design. > Recommended by whom? The Internet, or prominent experts in the field? It's recommended in several linux/unix books - physical books, written by experts - and in many blogs. So, both.
ahepp 3y ago
What threat model does fail2ban prevent, that couldn’t just be solved by using secure credentials?
- dreamcompiler 3y ago
  Let's say you lock your house's front door with a secure pass phrase while you're still inside. Once per second some stranger walks up to your door and knocks. You now get up from your chair, go to the door and say "Pass phrase please?" The knocker says "password123" and you say "Wrong, go away." But one second later they come back and knock and you have to get up and go to the door again. And again. And again. The bad guys never get in because they only try stupid passwords, but the constant getting up and going to the door gets pretty tiresome. So you get a dog, you put it outside your door and you train it to keep away for one minute any stranger who knocks but fails to get in. Now you have a lot more peace because you're not getting out of your chair every second to ask the pass phrase from some rando. Fail2ban is the dog.
  - ahepp 3y ago
    I have seen a lot of failed connection attempts in my logs, but never noticed substantial resource usage. Is SSH DoS a serious concern? I get the impression people are suggesting it to protect authentication, which makes basically zero sense to me.
    - dreamcompiler 3y ago
      F2B shrinks the attack surface. There's almost no chance of somebody getting in if you secure your server properly, but "almost no" is not zero, and making it even closer to zero seems like a good idea. My main concern is that some future update to SSHd will contain a zero-day vulnerability and F2B would at least slow the bad guys down. My second concern is that I might spin up a server and forget to disable SSH passwords and leave one enabled that happens to show up in a password database. Oof.
hyperman1 3y ago
I tend to work with whitelists instead of blacklists: I add only the IP ranges used by my ISP to the firewall whitelist. Most countries can't even ssh to my machines if they wanted to.

Why are they not using fail2ban?

csdreamer7 3y ago

Where did they say they did not use fail2ban?

udev4096 3y ago
I don't see any mention of it in the post

rlpb 3y ago

Here's a good list of reasons: https://www.opencve.io/cve?vendor=fail2ban https://www.opencve.io/cve?vendor=fail2ban Parsing log files not intended to be read by automation (eg. questionable or nonexistent escaping) to then take actions as root is with great remote injection vector is not a good idea.

15457345234 3y ago
That's a very very small list of vulnerabilities for such a widely used piece of software. Using fail2ban with SSH is very widely done and is thoroughly recommended. It increases security and is objectively a good idea.
- rlpb 3y ago
  > That's a very very small list of vulnerabilities for such a widely used piece of software. They are schoolboy errors in a relatively trivial piece of software that very well demonstrate the fundamental security flaw in its design. > is thoroughly recommended Recommended by whom? The Internet, or prominent experts in the field?
  - 15457345234 3y ago
    > They are schoolboy errors in a relatively trivial piece of software that very well demonstrate the fundamental security flaw in its design. I read through the CVEs and they're not 'schoolboy errors' at all - in fact, the first one doesn't even refer to fail2ban itself but to a program being called by fail2ban. There's no fundamental security flaw in its design. > Recommended by whom? The Internet, or prominent experts in the field? It's recommended in several linux/unix books - physical books, written by experts - and in many blogs. So, both.

ahepp 3y ago

What threat model does fail2ban prevent, that couldn’t just be solved by using secure credentials?

dreamcompiler 3y ago
Let's say you lock your house's front door with a secure pass phrase while you're still inside. Once per second some stranger walks up to your door and knocks. You now get up from your chair, go to the door and say "Pass phrase please?" The knocker says "password123" and you say "Wrong, go away." But one second later they come back and knock and you have to get up and go to the door again. And again. And again. The bad guys never get in because they only try stupid passwords, but the constant getting up and going to the door gets pretty tiresome. So you get a dog, you put it outside your door and you train it to keep away for one minute any stranger who knocks but fails to get in. Now you have a lot more peace because you're not getting out of your chair every second to ask the pass phrase from some rando. Fail2ban is the dog.
- ahepp 3y ago
  I have seen a lot of failed connection attempts in my logs, but never noticed substantial resource usage. Is SSH DoS a serious concern? I get the impression people are suggesting it to protect authentication, which makes basically zero sense to me.
  - dreamcompiler 3y ago
    F2B shrinks the attack surface. There's almost no chance of somebody getting in if you secure your server properly, but "almost no" is not zero, and making it even closer to zero seems like a good idea. My main concern is that some future update to SSHd will contain a zero-day vulnerability and F2B would at least slow the bad guys down. My second concern is that I might spin up a server and forget to disable SSH passwords and leave one enabled that happens to show up in a password database. Oof.

hyperman1 3y ago

I tend to work with whitelists instead of blacklists: I add only the IP ranges used by my ISP to the firewall whitelist. Most countries can't even ssh to my machines if they wanted to.