I believe the implication is that a properly configured server isn't going to allow passwords, and fail2ban isn't much more than a log size reducer when passwords aren't allowed.
Re:Who's Attacking My Server?
by randomtwiddler on Sunday March 13, 2022 @11:43PM
(#30668318)
I'm all about reducing the noise in log files.
I've had three production servers go down for various clients and the primary reason was full disk, primarily due to log files.
Re:Who's Attacking My Server?
by alternatetwo on Monday March 14, 2022 @02:03PM
(#30675758)
We've had a server go "down" due to log files too, but not because of size, but because of inodes. I think the samba server logged each incoming request into an empty text file with the IP. This eventually caused some problems, but we could still ssh in and delete the files ... but it's not fun to find out what even happened and to do that without autocomplete.
Nothing wrong with a decent password.
> time to find that your database is listening on 0.0.0.0
I think that this would be the norm and desirable for databases serving clients other than the local host's. Plopping the database server onto a public network and allowing anyone at all to talk to it, on the other hand...
If an remote vuln needs some stack-smashing technique that has a low probability of success, fail2ban is going to to slow that down - perhaps in a way that makes it more obvious in logs, buying you time to discover your broken configuration or out of date software. Same way that a firewall buys you time to find that your database is listening on 0.0.0.0.