5 ms·
That's why I use fail2ban, pretty much everywhere.
by sirclueless 14y ago
That's why I use fail2ban, pretty much everywhere.
- barrkel 14y agoFail2ban is massively heavyweight on a cheap virtual server however, easily consuming half your memory if you aren't careful, and still obscene amounts of RAM for the functionality, with tight ulimits.
- ars 14y agoTurn on a swap file and force it out. On one server it's (supposedly) using 192m - but only 5m is resident, the rest is swapped out or unused. On other 52m virt, but only 4m resident.
- barrkel 14y agoMaybe I'm old-fashioned, but I find even 4MB complete overkill for the required functionality. All the damn thing needs to do is keep a couple of running counters on a short buffer of IPs and run iptables when limits are met, and a periodic parse of a log file. This feels like something where 64k ought to be enough for anyone, much less 640k! Sure, we can get by with a fifth of a gigabyte of swap space for this task. Ugh. I've spent too much of my life in debugger CPU views. Jack's quivering tower of abstractions writhes in repulsion.
- ars 14y agoIt's written in python, which takes about about 2m-5m just to get out of bed with nothing loaded or running. (I don't consider that a lot BTW, not a ding on python.) There's about 200K of source code, but basically all the overhead is the python runtime. (The memory usage of python doing nothing varied on different machines, but was always virtually identical to the usage of fail2ban.) Also, the virt usage is mostly large memory mapped logfiles, not actual swap usage.
- ars 14y agoSeconded. And for even better security point fail2ban to itself, so that multiple bans result in an even longer 1 week ban. http://whyscream.net/wiki/index.php/Fail2ban_monitoring_Fail2ban http://whyscream.net/wiki/index.php/Fail2ban_monitoring_Fail...