3 ms·
I've never understood the point of fail2ban if you disable ssh password authentication. Yeah, it might eliminate some spam in the logs, but if you only allow k
by cdjk 14y ago
I've never understood the point of fail2ban if you disable ssh password authentication. Yeah, it might eliminate some spam in the logs, but if you only allow key-based authentication that doesn't really matter.
- denrober 14y agoMy only thought is even with password auth. turned off hostile persons can still connect to the ssh daemon and might discover and unknown vulnerability or some type of dos. If you know someone is trouble why let them in even if you are wearing armor?
- numbsafari 14y agoIt'd really suck if they could forge traffic from you that looked like a failed login attempt and that resulted in you getting banned.
- anderiv 14y agoThat is why fail2ban allows you to configure a whitelisted IP (your office, VPN, etc.) that will never get banned.
- MichaelGG 14y agofail2ban can deal with much more than SSH login attempts. I believe you can configure it to do arbitrary actions on arbitrary log events. Perhaps it comes with a block for HTTP, too? Seeing as he blocks SSH and only allows it from his IP, there won't be any SSH attempts reaching sshd at all, so fail2ban wouldn't be doing anything if it was looking at SSH only.
- petejansson 14y agoKeys can be brute-forced.
- deleted 14y ago[deleted]
- deleted 14y ago[deleted]
- deleted 14y ago[deleted]
- cdjk 14y agoThat is way down on my list of things to worry about.
- drivebyacct2 14y agoBreaking into the server warehouse and stealing data drives seems far, far, far more of a security threat.
- dchest 14y agoNo.
- drivebyacct2 14y agoPretty much, not to be a jerk but it's a bit alarming from someone claiming to do security consulting.
- mh- 14y agouh..