Hacker News Reader

> It's to easy to exploit as denial-of-service attack and can be used to lock out legitimate users.

Could you explain what's the "easy" way to DoS using fail2ban(or equivalent system)?

There's still a lot of ISPs that don't follow BCP-38 so source address IP spoofing is easy enough

SSH is TCP based, you need two-way handshake to construct the connection. Source address spoofing gets you only half-way there.

Unless your server's TCP stack has SYN-cookies enabled (and I think most do): http://www.jakoblell.com/blog/2013/08/13/quick-blind-tcp-con...

Law of unintended consequences strikes again.