3 ms·
fail2ban only blocks brute-force attacks from similar IPs right? What if a botnet is used to do the brute-force, does fail2ban lock everybody out, effectively
by martinced 14y ago
fail2ban only blocks brute-force attacks from similar IPs right?
What if a botnet is used to do the brute-force, does fail2ban lock everybody out, effectively making fail2ban a tool that can be used for Denial of Service?
All I'd have to do now is to hammer your system with SSH attempts from my botnet and you can't log in anymore...
- brokentone 14y agoIf my IP is on your botnet than I've got bigger issues than not getting into my server. Namely you stealing my password and you getting into my server.
- andybak 14y agoI think he means that fail2ban can't be effective against botnets attacks because if it didn't take IPs into account then it becomes a DDOS tool. Therefore it must take IPs into account. Therefore it's not protection against brute-force password guessing from a botnet.