Hacker News Reader

Comment by dbalan | Hacker News Reader

Using a tool like fail2ban is also favourable. Most of the bots will give up and look for other targets even if you ban them for a hour.

View on HN

The problem with fail2ban is that you have another possible vulnerable program that an external user can feed information to (although very restricted).

I have always been surprised that fail2ban is so popular, since iptables can do rate limiting, etc. So, it's easy to block most attacks with the in-kernel firewall:

http://www.debian-administration.org/articles/187

Here is the site: http://fail2ban.org

Since clearly you are confused what it actually does.

I know perfectly well what it does, and it does not change my point: extra parsing is extra scope for vulnerabilities. You also don't address my main point: you can use iptables rate limiting to block brute force SSH attempts. I used this for years and it works perfectly fine. Connecting to often within a certain timespan and you get DROP'ed.

But you probably thought that I was suggesting to block IPs by hand. I wasn't.

My understanding of fail2ban is that it watches logs and then creates iptables rules to reject IPs, not dropping them itself. Since it blocks after a number of attempts it does a rate limiting of sorts, and automates the process. I agree that using the firewall without an intermediary is more powerful and linux admins should know how to use it.

And traditionally anything like fail2ban, or denyhosts, has had issues of their own. For example mis-parsing malicious login attempts like this:

    ssh -l "root@ 1.2.4.5" ssh.example.com

Allowing you to lockout the specified IP.

I actually did find fail2ban in my Googling. Seems like a decent tool, have to do more research before I decide whether to use it from now on.

fail2ban is a log prettifier, doesn't actually add anything to security.

Could you elaborate on that? fail2ban seems quite popular for blocking malicious IPs.

No, fail2ban watches logs for repeatedly failed login attempts, and then blackholes given IPs using firewall rules. I prefer denyhosts, which is more ssh-specific.

from the user's profile https://news.ycombinator.com/user?id=kbar13

"I work for Linode, but everything I say is me being an idiot." so..

Given Linode's security record being an idiot or not seems irrelevant to me.

...so what exactly is it you're trying to read into his self-deprecation? Because it's not there.

Reply on news.ycombinator.com