131–140 of 268 posts
Earlier quoted context omitted.
This. I really do not understand why people use fail2ban when the threat is somewhere else. It won't stop a ddos but will certainly, at some point, prevent you from logging in.
20 years ago port-knocking was supposed to solve this issue for good but it seems to have been never really been taken up. I'm not sure why.
This site is now brought down due to the collective brute forcing of HNers visiting the site, as if akin to a DDOS. How ironic.
I did get one report that it was blocked by a corporate network because the domain was newly registered.
Earlier quoted context omitted.
20 years ago port-knocking was supposed to solve this issue for good but it seems to have been never really been taken up. I'm not sure why.
Because it doesn't solve any real problems if you have ssh password login disabled and filter out login failures from logs
A remark on your fail.js, since you’re engaging here and I figure this could interest you or others: Once there are more than thirty rows, you fade rows in like this: row.style.opacity = 0; let intervalId = setInterval(function() { opacity = Number(window.getComputedStyle(row).getPropertyValue("opacity")); if (opacity This would be better done with a CSS animation or transition—it takes less code, and is smoother. My…
While there may be millions of useless attempts, it only takes 1 to get through.
Of course SSH has a great option in key / certificate auth. So if that's enforced it's not such a big deal. Many other systems don't (at least not until we finally implement Passkeys everywhere).
So funny story, for a while I worked on a 'reverse' exploit. Which is to say morphing the response from ssh to the client with large malformed packets. The idea was to crash the client making the request. In my case I found these attacks would have like 6 to 10 attempts from the same source address. By time stamping the requests, I could evaluate if the next attack from the same address came more quickly or more slow…
Disable password authentication and fail2ban becomes completely unnecessary.
Earlier quoted context omitted.
This. I really do not understand why people use fail2ban when the threat is somewhere else. It won't stop a ddos but will certainly, at some point, prevent you from logging in.
I disable password authentication and use fail2ban. It's unlikely they will be able to brute force my key, but no server is perfect. sshd might be compromised one day. I’d rather have an extra layer of defense just in case.
While I'm sure it is possible for some (mainly government) actors to brute force keys, I'm also sure these do not include the same low-hanging-fruit vandals blasting brute force attacks. And I'm also pretty sure you're not one of the select targets of these highly advanced actors.
A vulnerability in sshd is indeed possible and happens once in a while. Fail2Ban won't stop this though because a known exploit will let them through on the first attempt.
I personally view fail2ban more as nuisance control when it comes to SSH with password auth disabled. Minimizing the log crap, the wasted CPU resources by the failed handshakes. It's not really a security protection in that scenario. In other cases (e.g. web logins where passwords must be used) it of course is.
So funny story, for a while I worked on a 'reverse' exploit. Which is to say morphing the response from ssh to the client with large malformed packets. The idea was to crash the client making the request. In my case I found these attacks would have like 6 to 10 attempts from the same source address. By time stamping the requests, I could evaluate if the next attack from the same address came more quickly or more slow…
Earlier quoted context omitted.
> This. I really do not understand why people use fail2ban when the threat is somewhere else. Fail2ban keeps my log short enough that I can review them daily, I don't have to sift through thousands of login attempt. > It won't stop a ddos but will certainly, at some point, prevent you from logging in. Yup, losing my key and having no password access will do that.
I'm not sure manual log scanning is all that interesting. You probably want to produce a list of successful logins and review that regularly.