Fail2ban may provide a false sense of security

lonea

This is so unnecessary.

We are in 2019. Your server is powerful enough to handle a few thousands of brute force logins.

eastonch

lonea said: We are in 2019. Your server is powerful enough to handle a few thousands of brute force logins.

Yes, yes it is. However, do you really want them to have unlimited attempts at guessing correct credentials? No. I've always used fail2ban to ban logins after 5 fails for 24 hours.

Neoon

@lonea said:
This is so unnecessary.

We are in 2019. Your server is powerful enough to handle a few thousands of brute force logins.

If you want that a stranger, touches your nuts, multiple times while you go over the street, okay then.

I prefer, firewalls, thats that millennials thing, it works.

Besides, who knows, maybe there are security holes in SSH2, which are big enough, to fuck everyone without firewalls.
So I do suggest, firewalling, instead of going the yolo way.

poisson

@Neoon said:
If you want that a stranger, touches your nuts, multiple times while you go over the street, okay then.

LET comment of the week.

Anyway, port knocking sounds like a great concept. Going to try it.

lonea

-hosts.allow
-only permit SSH key to login

Both are more efficient than firewalling the whole world off.

Neoon said: If you want that a stranger, touches your nuts, multiple times while you go over the street, okay then.

I prefer, firewalls, thats that millennials thing, it works.

Besides, who knows, maybe there are security holes in SSH2, which are big enough, to fuck everyone without firewalls.

So I do suggest, firewalling, instead of going the yolo way.

lonea

Within the scope of this thread, it's not really unlimited when you have fail2ban or CSF installed.

Whitelisting is good when the server is not public or used by multiple users.

eastonch said: Yes, yes it is. However, do you really want them to have unlimited attempts at guessing correct credentials? No. I've always used fail2ban to ban logins after 5 fails for 24 hours.