News for hackers. Stuff that matters.
Re:Some thoughts on OpenSSH 9.8's PerSourcePenalties feature by catkitcourt on Wednesday August 14, 2024 @01:29PM (#41248463)
What’s the difference between fail2ban? Though I feel neither of those two works now.
Re:Some thoughts on OpenSSH 9.8's PerSourcePenalties feature by kemitche on Wednesday August 14, 2024 @03:41PM (#41249743)
Seems similar, except that this is built-in to sshd vs having to install a separate tool. It's also enabled by default here in sshd.
Re:Some thoughts on OpenSSH 9.8's PerSourcePenalties feature by niobe on Wednesday August 14, 2024 @07:15PM (#41251560)
fail2ban works just fine with sshd. I combine this GeoIP blocking ceetain troublesome locations in firewalls. 98% of my scanning / exploiting comes from 11 countries.
Re:Some thoughts on OpenSSH 9.8's PerSourcePenalties feature by bigiain on Wednesday August 14, 2024 @08:51PM (#41252201)
fail2ban is great, but only works on the local host.

The post says: "Right now our perimeter firewall is blind to whether a brief SSH connection was successful or not"

(I suspect there's a way to set up centralised logging and fail2ban running looking at those centralised logs and sending updates to a perimeter firewall, but that's not a typical deployment of fail2ban. Or at least is wasn't when I was heavily using it a while back.)