Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by plz-remove-card | Hacker News Reader

Full thread

plz-remove-card·

On {Free,Net}BSD[1][2] you get Bl*cklistd which is a much better approach than parsing log files.

[1] https://man.freebsd.org/cgi/man.cgi?query=blacklistd&sektion...

[2] https://man.netbsd.org/blocklistd.8

View on HN

Isn't that specifically DoS oriented? Doesn't seem to cover fail2ban's use case.

No, once an IP had failed authentication a configured number of times, the IP is blocked (for a configurable amount of time.)

What does it mean for an IP to fail “authentication” in that context? As I understand, they only check for failed connection attempts, not failed authentications?

The first thing it was integrated into was sshd, there's a small patch in sshd that sends a notification to the blacklist daemon when a connection has failed authentication.

Got it, thanks. It was surprisingly hard to find details about it except for the man page.

If you're interested in an overview, I'd recommend this vid from the author: https://www.youtube.com/watch?v=fuuf8G28mjs&t=74s

Thanks for that too!

The difference is blacklistd is just a api and a database for telling the firewall to block ip's. The decision to inform blacklistd is on the application side, and not a scanner that checks the log's produced by that application.

And yes, DoS is a very good example, if your application writes so much log's (during a attack) and fail2ban has to analyze them during that, then machine could very well DoS itself, the blacklistd approach is much simpler and straightforward BUT (and that's a big one) the applications has to support it.

Thanks!

The primary author died in 2019. Is it still being worked on? I agree it seems like a superior approach.

Reply on news.ycombinator.com