Hacker News Reader

Comment by udev4096 | Hacker News Reader

Why are they not using fail2ban?

Here's a good list of reasons: https://www.opencve.io/cve?vendor=fail2ban

Parsing log files not intended to be read by automation (eg. questionable or nonexistent escaping) to then take actions as root is with great remote injection vector is not a good idea.

That's a very very small list of vulnerabilities for such a widely used piece of software.

Using fail2ban with SSH is very widely done and is thoroughly recommended. It increases security and is objectively a good idea.

> That's a very very small list of vulnerabilities for such a widely used piece of software.

They are schoolboy errors in a relatively trivial piece of software that very well demonstrate the fundamental security flaw in its design.

> is thoroughly recommended

Recommended by whom? The Internet, or prominent experts in the field?

> They are schoolboy errors in a relatively trivial piece of software that very well demonstrate the fundamental security flaw in its design.

I read through the CVEs and they're not 'schoolboy errors' at all - in fact, the first one doesn't even refer to fail2ban itself but to a program being called by fail2ban.

There's no fundamental security flaw in its design.

> Recommended by whom? The Internet, or prominent experts in the field?

It's recommended in several linux/unix books - physical books, written by experts - and in many blogs. So, both.

I tend to work with whitelists instead of blacklists: I add only the IP ranges used by my ISP to the firewall whitelist. Most countries can't even ssh to my machines if they wanted to.

What threat model does fail2ban prevent, that couldn’t just be solved by using secure credentials?

Let's say you lock your house's front door with a secure pass phrase while you're still inside. Once per second some stranger walks up to your door and knocks. You now get up from your chair, go to the door and say "Pass phrase please?"

The knocker says "password123" and you say "Wrong, go away." But one second later they come back and knock and you have to get up and go to the door again. And again. And again.

The bad guys never get in because they only try stupid passwords, but the constant getting up and going to the door gets pretty tiresome.

So you get a dog, you put it outside your door and you train it to keep away for one minute any stranger who knocks but fails to get in.

Now you have a lot more peace because you're not getting out of your chair every second to ask the pass phrase from some rando.

Fail2ban is the dog.

I have seen a lot of failed connection attempts in my logs, but never noticed substantial resource usage. Is SSH DoS a serious concern? I get the impression people are suggesting it to protect authentication, which makes basically zero sense to me.

F2B shrinks the attack surface. There's almost no chance of somebody getting in if you secure your server properly, but "almost no" is not zero, and making it even closer to zero seems like a good idea. My main concern is that some future update to SSHd will contain a zero-day vulnerability and F2B would at least slow the bad guys down. My second concern is that I might spin up a server and forget to disable SSH passwords and leave one enabled that happens to show up in a password database. Oof.

Where did they say they did not use fail2ban?

I don't see any mention of it in the post

Reply on news.ycombinator.com