Re:Fail2ban Sucks
by sureglymop on Monday January 01, 2024 @07:38PM
(#38836750)
If it's not some sort of proxy/firewall remapping the port, you probably shouldn't use a port above 1000 for some services.
Consider this: an attacker (somehow) managed to get user access to your server. They can now dos the service until it crashes and then start their own service listening on that same port, maybe impersonating your service. Maybe they can use that to grab sensitive information or do something else.
Re:Fail2ban Sucks
by bshipp on Monday January 01, 2024 @11:26PM
(#38838107)
Indeed, although because I heavily utilized Docker I also ended up using UFW-Docker. It was fairly straightforward to incorporate into my startup scripts.
Consider this: an attacker (somehow) managed to get user access to your server. They can now dos the service until it crashes and then start their own service listening on that same port, maybe impersonating your service. Maybe they can use that to grab sensitive information or do something else.