3 ms·

The problem with fail2ban is that you have another possible vulnerable program that an external user can feed information to (although very restricted). I have

• threeseed 12y ago
  Here is the site: http://fail2ban.org http://fail2ban.org Since clearly you are confused what it actually does.
  • danieldk 12y ago
    I know perfectly well what it does, and it does not change my point: extra parsing is extra scope for vulnerabilities. You also don't address my main point: you can use iptables rate limiting to block brute force SSH attempts. I used this for years and it works perfectly fine. Connecting to often within a certain timespan and you get DROP'ed. But you probably thought that I was suggesting to block IPs by hand. I wasn't.
• hhtpcd 12y ago
  My understanding of fail2ban is that it watches logs and then creates iptables rules to reject IPs, not dropping them itself. Since it blocks after a number of attempts it does a rate limiting of sorts, and automates the process. I agree that using the firewall without an intermediary is more powerful and linux admins should know how to use it.
• stevekemp 12y ago
  And traditionally anything like fail2ban, or denyhosts, has had issues of their own. For example mis-parsing malicious login attempts like this: ssh -l "root@ 1.2.4.5" ssh.example.com Allowing you to lockout the specified IP.