Re:Fail2ban security update
by kazinator on Thursday July 17, 2014 @06:10PM
(#8050523)
In addition to the other responses:
tools like fail2ban are not only for SSH!
I also use log monitoring and banning to ban http connections to my web server (driven by scanning apache logs), as well as SMTP connections (scanning Exim's rejectlog).
The rationale "do not use password authentication" does not apply to unauthenticated HTTP and SMTP requests.
Re:Fail2ban security update
by feld on Saturday July 19, 2014 @04:48PM
(#8058668)
we do that at work. Found it to painful to make fail2ban to watch to hundreds of vhost log files so we just sniff the requests with ngrep and log them to a file fail2ban watches
tools like fail2ban are not only for SSH!
I also use log monitoring and banning to ban http connections to my web server (driven by scanning apache logs), as well as SMTP connections (scanning Exim's rejectlog).
The rationale "do not use password authentication" does not apply to unauthenticated HTTP and SMTP requests.