Hacker News Reader

Comment by cdjk | Hacker News Reader

I've never understood the point of fail2ban if you disable ssh password authentication. Yeah, it might eliminate some spam in the logs, but if you only allow key-based authentication that doesn't really matter.

View on HN

fail2ban can deal with much more than SSH login attempts. I believe you can configure it to do arbitrary actions on arbitrary log events. Perhaps it comes with a block for HTTP, too?

Seeing as he blocks SSH and only allows it from his IP, there won't be any SSH attempts reaching sshd at all, so fail2ban wouldn't be doing anything if it was looking at SSH only.

My only thought is even with password auth. turned off hostile persons can still connect to the ssh daemon and might discover and unknown vulnerability or some type of dos. If you know someone is trouble why let them in even if you are wearing armor?

It'd really suck if they could forge traffic from you that looked like a failed login attempt and that resulted in you getting banned.

That is why fail2ban allows you to configure a whitelisted IP (your office, VPN, etc.) that will never get banned.

Keys can be brute-forced.

That is way down on my list of things to worry about.

Breaking into the server warehouse and stealing data drives seems far, far, far more of a security threat.

No.

Pretty much, not to be a jerk but it's a bit alarming from someone claiming to do security consulting.

uh..

Reply on news.ycombinator.com