4 ms·

fail2ban

• danieldk 13y ago
  And now you have another exploitable venue, the log parser of fail2ban ;). Personally, I trust netfilter/iptables' rate limiting more.
  • MertsA 13y ago
    Even better yet is pam_abl. If any IP or user fails authentication faster than a configured rate pam_abl will block logging into that user or any authentication attempts coming from the same IP address and it's all nicely tied into PAM so you don't have to worry about yet another fail2ban vulnerability or someone spoofing some important IP address and tricking your server into blocking it.
    • davis_m 13y ago
      Using pam_abl to disallow logging into an account that is being hit sounds like a easy way to DoS a box.