News for hackers. Stuff that matters.

A comment on A Linux botnet is launching crippling DDoS attacks in excess of 150Gbps. Parent comment

Re:A Linux botnet is launching crippling DDoS attacks in exc... by IE6 on Wednesday September 30, 2015 @09:14AM (#10303629)
Fail2Ban is great - I've used it for more than just blocking brute force attacks on ssh (although a real security expert might say this is the wrong tool to use).
[ Parent | on HN ]
Re:A Linux botnet is launching crippling DDoS attacks in exc... by gingerlime on Friday October 02, 2015 @03:16AM (#10317142)
Yep, I also use it to detect repeat errors on our own application logs and block offending IPs.

Fail2ban has a reasonably easy to tweak detection and blocking rules, plus lots of available ready-made ones that do the job. If you're comfortable with regular expressions (which most people on HN probably are), then it's really straight-forward to write your own rules.

The only problem I encountered with it is when you start it up and you have a huge amount of data in your log files. It can cause 100% cpu usage for a long time until it digests the whole thing...

[ Parent | on HN ]