Comment by zsoltkacsandi | Hacker News Reader

Comment by zsoltkacsandi | Hacker News Reader

Parent Full thread

> Application Intrusion Detection And Prevention With Fail2Ban

Please stop recommending fail2ban for securing/hardening servers and applications.

It is mentioned even it’s readme that:

> Though Fail2Ban is able to reduce the rate of incorrect authentication attempts, it cannot eliminate the risk presented by weak authentication.

It provides a false sense of security.

fail2ban only makes sense where sane defaults cannot be applied (password auth, no MFA, etc.) in some very special (and justifiable) cases, but regular self-hosters really shouldn’t host these applications. If you are targeted by a serious attacker, fail2ban’s “protection” can be easily bypassed with a large enough botnet, or simply moving on with exploiting another vulnerability/attack vector.

It has the benefit of banning bots that hammer you SSH trying to log in. Even if password auth is disabled. I've had friends that setup a small VPS and they've been hammered by bots, which can use a lot of resource on a £5/£10 VPS. Told them to install fail2ban, and the issue was solved in a few minutes.

Good security is about having multiple layers of defense. Fail2Ban protection is one of those layers.

> It has the benefit of banning bots that hammer you SSH trying to log in. Even if password auth is disabled.

You can use the built-in firewall for that (`ufw limit ssh`).

> I've had friends that setup a small VPS and they've been hammered by bots, which can use a lot of resource on a £5/£10 VPS.

`ufw limit ssh` solves this as well, performant, efficient, nothing else needed than the built-in firewall. If you are targeted by a botnet, fail2ban will solve nothing.

> Good security is about having multiple layers of defense. Fail2Ban protection is one of those layers.

Let me quote again the readme of fail2ban: "Set up services to use only two factor, or public/private authentication mechanisms if you really want to protect services."

True defense in depth means choosing effective layers, not putting arbitrary layers on top of each other. Defense in depth doesn't mean every possible layer is good.

You want layers that meaningfully improve your security posture without adding unnecessary complexity or false confidence.

Reply on news.ycombinator.com