4 ms·
Using a tool like fail2ban is also favourable. Most of the bots will give up and look for other targets even if you ban them for a hour.
by dbalan 12y ago
Using a tool like fail2ban is also favourable. Most of the bots will give up and look for other targets even if you ban them for a hour.
- kbar13 12y agofail2ban is a log prettifier, doesn't actually add anything to security.
- mp4box 12y agofrom the user's profile https://news.ycombinator.com/user?id=kbar13 https://news.ycombinator.com/user?id=kbar13 "I work for Linode, but everything I say is me being an idiot." so..
- threeseed 12y agoGiven Linode's security record being an idiot or not seems irrelevant to me.
- forgottenpass 12y ago...so what exactly is it you're trying to read into his self-deprecation? Because it's not there.
- agranig 12y agoCould you elaborate on that? fail2ban seems quite popular for blocking malicious IPs.
- pronoiac 12y agoNo, fail2ban watches logs for repeatedly failed login attempts, and then blackholes given IPs using firewall rules. I prefer denyhosts, which is more ssh-specific.
- danieldk 12y agoThe problem with fail2ban is that you have another possible vulnerable program that an external user can feed information to (although very restricted). I have always been surprised that fail2ban is so popular, since iptables can do rate limiting, etc. So, it's easy to block most attacks with the in-kernel firewall: http://www.debian-administration.org/articles/187 http://www.debian-administration.org/articles/187
- threeseed 12y agoHere is the site: http://fail2ban.org http://fail2ban.org Since clearly you are confused what it actually does.
- danieldk 12y agoI know perfectly well what it does, and it does not change my point: extra parsing is extra scope for vulnerabilities. You also don't address my main point: you can use iptables rate limiting to block brute force SSH attempts. I used this for years and it works perfectly fine. Connecting to often within a certain timespan and you get DROP'ed. But you probably thought that I was suggesting to block IPs by hand. I wasn't.
- hhtpcd 12y agoMy understanding of fail2ban is that it watches logs and then creates iptables rules to reject IPs, not dropping them itself. Since it blocks after a number of attempts it does a rate limiting of sorts, and automates the process. I agree that using the firewall without an intermediary is more powerful and linux admins should know how to use it.
- stevekemp 12y agoAnd traditionally anything like fail2ban, or denyhosts, has had issues of their own. For example mis-parsing malicious login attempts like this: ssh -l "root@ 1.2.4.5" ssh.example.com Allowing you to lockout the specified IP.
- artursapek 12y agoI actually did find fail2ban in my Googling. Seems like a decent tool, have to do more research before I decide whether to use it from now on.