3 ms·
I've used fail2ban in production for many years but eventually removed it due to causing very large iptables leading high memory use and ultimately a source of
by tomxor 2y ago
I've used fail2ban in production for many years but eventually removed it due to causing very large iptables leading high memory use and ultimately a source of instability for other services (i.e it turns into a DDoS vulnerability for the whole server). I know the usual advice then is to reduce ban time and just not have permabanning, but that seems to kind of defeat the purpose.
I wonder how this SSH feature differs since it's implemented at the SSH level.
So long as the SSH and or PAM config requires more than a password (I use hardware keys), the main concern to me is log noise (making it hard to identify targeted security threats) and SSH DDoS. I know tarpits and alternative ports are another way of dealing with that, but when SSH is used for many things having to change the port is kind of annoying.
I think I'm probably just going to end up layering it like everyone else and stick everything behind a wireguard gateway, although that concept makes me slightly anxious about that single point of access failure.
- yjftsjthsd-h 2y ago> I've used fail2ban in production for many years but eventually removed it due to causing very large iptables leading high memory use and ultimately a source of instability for other services (i.e it turns into a DDoS vulnerability for the whole server). I know the usual advice then is to reduce ban time and just not have permabanning, but that seems to kind of defeat the purpose. Didn't the advice switch to using ipset a while back, precisely in the name of efficiency?
- deleted 2y ago[deleted]
- tomxor 2y agoInteresting thanks, I hadn't heard of that option.
- KennyBlanken 2y ago> causing very large iptables leading high memory use > I know the usual advice then is to reduce ban time and just not have permabanning, but that seems to kind of defeat the purpose. The purpose is to make random password attempts even more impractical. With even fairly lax fail2ban rules, it'll take multiple lifetimes to find a password made up of just two common use english words. However, that's not really their goal. I think that these SSH probes are mostly intended to find systems that have been compromised and have common backdoor passwords, though. ...and they use networks of zombie machines to do it. That's where stuff like Crowdsec and IP ban lists come in, with the side benefit of your IP addresses becoming less 'visible'
- tomxor 2y ago>> I know the usual advice then is to reduce ban time and just not have permabanning, but that seems to kind of defeat the purpose. > The purpose is to make random password attempts even more impractical. With even fairly lax fail2ban rules, it'll take multiple lifetimes to find a password made up of just two common use english words. True, but the other reason to use such a measure is layered security. For instance I systematically disable all password only access, which kind of makes fail2ban seem a little pointless, but if there were to be some obscure bug in PAM, or SSH, or more likely a misconfiguration, then there is another layer that makes it more difficult.
- yardstick 2y agoSounds like you were running SSH on the default port tcp/22? I would expect attacks to exponentially drop off as soon as you move to a custom port.