6 ms·

If you have only public key authentication enabled with SSH I honestly don't understand why people bother with things like fail2ban. It just adds more moving pa

If you have only public key authentication enabled with SSH I honestly don't understand why people bother with things like fail2ban. It just adds more moving parts with very little security gain. The real risk is a zero-day in OpenSSH and fail2ban probably isn't going to protect you from that. In that case you are better served by putting another layer of defense in front of SSH like a VPN.

jcynix 2y ago
Fully agree. Limiting the networks which can access your server will help, e.g. limit access to just your local provider or your workplace and you'll see no attempts from Brazil, China, ... unless you are located there, of course ;-)
- ajsnigrutin 2y ago
  It's all fun and games, until you travel outside of your country, and try to access stuff at home.
  - euler2100 2y ago
    Tailscale (et al)?
  - jcynix 2y ago
    That's manageable with a bit of preparation: when I'm travelling, I allow access from other networks, e.g. those from phone providers. Or add a web form where I activate the IP address with a cryptographically signed "token" which the server can verify and then add the IP address to the set of allowed ones. Used one or the other every now and then in the last 10+ years and still have my attackable footprint small the rest of the time.
mekster 2y ago
Repetitive log is something you appreciate by reducing and you don't have to give it unnecessary CPU cycles too.
BrandoElFollito 2y ago
fail2ban is the kind of pseudo-security applied just because someone's cousin mentioned that in his blog. It provides zero security. If your endpoint uses default usernames you will be shot anyway because of IP spread. If your security is good you add something that will block your legitimate connection when you are in the middle of nowhere and, shit, cannot access your <some service>.
- d-z-m 2y ago
  "security" is a term that has to be defined in relation to a threat model. If your threat model is an attacker with a static IP hammering your server, fail2ban does provide some security against that sort of attacker.
  - BrandoElFollito 2y ago
    No it does not. If the packet is at your door it is too late already. Then either it does not matter in which case you do nothing, or it matters (DoS) and then you have other problems. You are right that security works in the context of a threat model. There are however useless tools that give a false sense of "security" that do not fit in any reasonable model. I have cases where I block whole ranges of IPs for "legal" reasons - it does not make sense but there you are, the ones who write the rules are not the ones who actually know the stuff.
    - d-z-m 2y ago
      > No it does not. If the packet is at your door it is too late already. Too late for what? Again, it only makes sense to talk about "security" in the context of a threat model. You can debate the reasonableness of that threat model, but that's another discussion. My threat model(for the sake of argument :^)) is an attacker with a static public IP address trying to bruteforce access to my service via repeated login attempts. I'll maintain(for now) that fail2ban can be an effective tool that does provide some security against an attacker of this kind.
      - 2y ago
Too 2y ago
How do you protect your vpn?
- d-z-m 2y ago
  use a vpn that does not advertise its presence, like wireguard.

jcynix 2y ago

Fully agree. Limiting the networks which can access your server will help, e.g. limit access to just your local provider or your workplace and you'll see no attempts from Brazil, China, ... unless you are located there, of course ;-)

ajsnigrutin 2y ago
It's all fun and games, until you travel outside of your country, and try to access stuff at home.
- euler2100 2y ago
  Tailscale (et al)?
- jcynix 2y ago
  That's manageable with a bit of preparation: when I'm travelling, I allow access from other networks, e.g. those from phone providers. Or add a web form where I activate the IP address with a cryptographically signed "token" which the server can verify and then add the IP address to the set of allowed ones. Used one or the other every now and then in the last 10+ years and still have my attackable footprint small the rest of the time.

mekster 2y ago

Repetitive log is something you appreciate by reducing and you don't have to give it unnecessary CPU cycles too.

BrandoElFollito 2y ago

fail2ban is the kind of pseudo-security applied just because someone's cousin mentioned that in his blog. It provides zero security. If your endpoint uses default usernames you will be shot anyway because of IP spread. If your security is good you add something that will block your legitimate connection when you are in the middle of nowhere and, shit, cannot access your <some service>.

d-z-m 2y ago
"security" is a term that has to be defined in relation to a threat model. If your threat model is an attacker with a static IP hammering your server, fail2ban does provide some security against that sort of attacker.
- BrandoElFollito 2y ago
  No it does not. If the packet is at your door it is too late already. Then either it does not matter in which case you do nothing, or it matters (DoS) and then you have other problems. You are right that security works in the context of a threat model. There are however useless tools that give a false sense of "security" that do not fit in any reasonable model. I have cases where I block whole ranges of IPs for "legal" reasons - it does not make sense but there you are, the ones who write the rules are not the ones who actually know the stuff.
  - d-z-m 2y ago
    > No it does not. If the packet is at your door it is too late already. Too late for what? Again, it only makes sense to talk about "security" in the context of a threat model. You can debate the reasonableness of that threat model, but that's another discussion. My threat model(for the sake of argument :^)) is an attacker with a static public IP address trying to bruteforce access to my service via repeated login attempts. I'll maintain(for now) that fail2ban can be an effective tool that does provide some security against an attacker of this kind.
    - 2y ago

Too 2y ago

How do you protect your vpn?

d-z-m 2y ago
use a vpn that does not advertise its presence, like wireguard.