DigitalOcean Raises $37.2M From Andreessen Horowitz to Take on AWS

Re:DigitalOcean Raises $37.2M From Andreessen Horowitz to Ta... by mindcrime on Thursday March 06, 2014 @07:52PM (#7357714)

I'm not sure, but I've come around to realize that it's always worth installing and configuring fail2ban just for the reasons you mentioned, if nothing else. I have a demo server that, for a while, was being hammered so hard by ssh brute-force bots that it kept getting knocked offline. I installed fail2ban and no more problems since. I personally can't recommend fail2ban highly enough.

[ Parent | on HN ]

Re:DigitalOcean Raises $37.2M From Andreessen Horowitz to Ta... by MertsA on Friday March 07, 2014 @05:01AM (#7359395)

fail2ban is based on the horribly flawed premise of correctly parsing arbitrary text logs from tons of different programs that wrote their log format without any concerns about parsing that output later. Not surprisingly there have been numerous vulnerabilities in fail2ban that let an attacker ban arbitrary hosts such as your DNS server, database, etc.

https://www.google.com/search?q=fail2ban+dos+bug

A better approach is something like pam_abl which is a pam module that will accomplish mostly the same thing but only for login attempts and without the crappy plain text log parsing.

[ Parent | on HN ]

Re:DigitalOcean Raises $37.2M From Andreessen Horowitz to Ta... by flexd on Friday March 07, 2014 @04:04AM (#7359196)

Have you tried denyhosts?

I've always been installing denyhosts but I have not compared the two.

[ Parent | on HN ]