Fail2ban - Revision history

M at 14:05, 30 November 2017

2017-11-30T14:05:43Z

← Older revision		Revision as of 14:05, 30 November 2017
Line 17:		Line 17:
	Still not working yet...		Still not working yet...

	* Check out port knocking - not convenient? not sure yet
	* consider a non-default port - but that is not convenient
	* check out [https://github.com/denyhosts/denyhosts denyhosts]
	* turn off passwords entirely! best, but possibly not convenient		* turn off passwords entirely! best, but possibly not convenient
	** make sure to set up juicessh with the key		** make sure to set up juicessh with the key
	** make sure you have a script you can run from bitpost to temporarily turn it back on to set up new machines, run from phone and then start a cron job to turn it off in x minutes		** make sure you have a script you can run from bitpost to temporarily turn it back on to set up new machines, run from phone and then start a cron job to turn it off in x minutes
			* check out [https://github.com/denyhosts/denyhosts denyhosts]

			other ideas that aren't sounding as good on second thought...

			* Check out port knocking - not convenient? not sure yet
			* consider a non-default port - but that is not convenient
	* deep dive into how to set up a truly painful tarpit for attackers		* deep dive into how to set up a truly painful tarpit for attackers
	** [http://mikhailian.mova.org/node/147 slow down response] - ok moron but not on good attempts, i need 300 or so simultaneous connections		** [http://mikhailian.mova.org/node/147 slow down response] - ok moron but not on good attempts, i need 300 or so simultaneous connections
	** check out this FUCKING RIGHTEOUS [https://sysadminblog.net/2013/08/debian-iptables-tarpit/ tarpit]		** check out this FUCKING RIGHTEOUS [https://sysadminblog.net/2013/08/debian-iptables-tarpit/ tarpit]
	** AND... here's why you shouldn't do a tarpit without a shitton of protective work, you'll get [https://serverfault.com/questions/611063/does-tarpit-have-any-known-vulnerabilities-or-downsides/638899#638899 DOS'ed]		** AND... here's why you shouldn't do a tarpit without a shitton of protective work, you'll get [https://serverfault.com/questions/611063/does-tarpit-have-any-known-vulnerabilities-or-downsides/638899#638899 DOS'ed]

M at 14:04, 30 November 2017

2017-11-30T14:04:30Z

← Older revision		Revision as of 14:04, 30 November 2017
Line 26:		Line 26:
	** [http://mikhailian.mova.org/node/147 slow down response] - ok moron but not on good attempts, i need 300 or so simultaneous connections		** [http://mikhailian.mova.org/node/147 slow down response] - ok moron but not on good attempts, i need 300 or so simultaneous connections
	** check out this FUCKING RIGHTEOUS [https://sysadminblog.net/2013/08/debian-iptables-tarpit/ tarpit]		** check out this FUCKING RIGHTEOUS [https://sysadminblog.net/2013/08/debian-iptables-tarpit/ tarpit]
			** AND... here's why you shouldn't do a tarpit without a shitton of protective work, you'll get [https://serverfault.com/questions/611063/does-tarpit-have-any-known-vulnerabilities-or-downsides/638899#638899 DOS'ed]

M at 13:57, 30 November 2017

2017-11-30T13:57:31Z

← Older revision		Revision as of 13:57, 30 November 2017
Line 25:		Line 25:
	* deep dive into how to set up a truly painful tarpit for attackers		* deep dive into how to set up a truly painful tarpit for attackers
	** [http://mikhailian.mova.org/node/147 slow down response] - ok moron but not on good attempts, i need 300 or so simultaneous connections		** [http://mikhailian.mova.org/node/147 slow down response] - ok moron but not on good attempts, i need 300 or so simultaneous connections
			** check out this FUCKING RIGHTEOUS [https://sysadminblog.net/2013/08/debian-iptables-tarpit/ tarpit]

M at 13:51, 30 November 2017

2017-11-30T13:51:30Z

← Older revision		Revision as of 13:51, 30 November 2017
Line 17:		Line 17:
	Still not working yet...		Still not working yet...

	* Check out port knocking on a non-default port		* Check out port knocking - not convenient? not sure yet
			* consider a non-default port - but that is not convenient
	* check out [https://github.com/denyhosts/denyhosts denyhosts]		* check out [https://github.com/denyhosts/denyhosts denyhosts]
	* turn off passwords entirely!		* turn off passwords entirely! best, but possibly not convenient
	** make sure to set up juicessh with the key		** make sure to set up juicessh with the key
	** make sure you have a script you can run from bitpost to temporarily turn it back on to set up new machines, run from phone and then start a cron job to turn it off in x minutes		** make sure you have a script you can run from bitpost to temporarily turn it back on to set up new machines, run from phone and then start a cron job to turn it off in x minutes
	* deep dive into how to set up a truly painful tarpit for attackers		* deep dive into how to set up a truly painful tarpit for attackers
			** [http://mikhailian.mova.org/node/147 slow down response] - ok moron but not on good attempts, i need 300 or so simultaneous connections

M at 13:48, 30 November 2017

2017-11-30T13:48:00Z

← Older revision		Revision as of 13:48, 30 November 2017
Line 19:		Line 19:
	* Check out port knocking on a non-default port		* Check out port knocking on a non-default port
	* check out [https://github.com/denyhosts/denyhosts denyhosts]		* check out [https://github.com/denyhosts/denyhosts denyhosts]
	* turn off passwords entirely! ~~and~~ make sure you have a script you can run from bitpost to temporarily turn it back on to set up new machines		* turn off passwords entirely!
			** make sure to set up juicessh with the key
			** make sure you have a script you can run from bitpost to temporarily turn it back on to set up new machines, run from phone and then start a cron job to turn it off in x minutes
	* deep dive into how to set up a truly painful tarpit for attackers		* deep dive into how to set up a truly painful tarpit for attackers

M at 13:46, 30 November 2017

2017-11-30T13:46:16Z

← Older revision		Revision as of 13:46, 30 November 2017
Line 18:		Line 18:

	* Check out port knocking on a non-default port		* Check out port knocking on a non-default port
			* check out [https://github.com/denyhosts/denyhosts denyhosts]
	* turn off passwords entirely! and make sure you have a script you can run from bitpost to temporarily turn it back on to set up new machines		* turn off passwords entirely! and make sure you have a script you can run from bitpost to temporarily turn it back on to set up new machines
	* deep dive into how to set up a truly painful tarpit for attackers		* deep dive into how to set up a truly painful tarpit for attackers

M at 13:37, 30 November 2017

2017-11-30T13:37:37Z

← Older revision		Revision as of 13:37, 30 November 2017
Line 17:		Line 17:
	Still not working yet...		Still not working yet...

	Check out port knocking, and deep dive into how to set up a truly painful tarpit for attackers		* Check out port knocking on a non-default port
			* turn off passwords entirely! and make sure you have a script you can run from bitpost to temporarily turn it back on to set up new machines
			* deep dive into how to set up a truly painful tarpit for attackers

M at 13:35, 30 November 2017

2017-11-30T13:35:17Z

← Older revision		Revision as of 13:35, 30 November 2017
Line 16:		Line 16:

	Still not working yet...		Still not working yet...

			Check out port knocking, and deep dive into how to set up a truly painful tarpit for attackers

M at 21:03, 16 November 2017

2017-11-16T21:03:31Z

← Older revision		Revision as of 21:03, 16 November 2017
Line 14:		Line 14:
	\|- Number of jail: 1		\|- Number of jail: 1
	`- Jail list: mdmjail		`- Jail list: mdmjail

			Still not working yet...

M at 20:51, 16 November 2017

2017-11-16T20:51:52Z

← Older revision		Revision as of 20:51, 16 November 2017
Line 3:		Line 3:
	It takes a few commands to get going though, and I guess it doesn't run as a normal service?		It takes a few commands to get going though, and I guess it doesn't run as a normal service?

	🌵 m@bitpost [~~~/development/thedigitalage/rad-scripts~~]sudo fail2ban-client add mdmjail		🌵 m@bitpost [~]sudo fail2ban-client add mdmjail
	Added jail mdmjail		Added jail mdmjail
	🌵 m@bitpost [~~~/development/thedigitalage/rad-scripts~~] sudo fail2ban-client start mdmjail		🌵 m@bitpost [~] sudo fail2ban-client start mdmjail
	Jail started		Jail started
	🌵 m@bitpost [~~~/development/thedigitalage/rad-scripts~~] sudo fail2ban-client set mdmjail addlogpath /var/log/messages		🌵 m@bitpost [~] sudo fail2ban-client set mdmjail addlogpath /var/log/messages
	Current monitored log file(s):		Current monitored log file(s):
	`- /var/log/messages		`- /var/log/messages
	🌵 m@bitpost [~~~/development/thedigitalage/rad-scripts~~]sudo fail2ban-client status		🌵 m@bitpost [~]sudo fail2ban-client status
	Status		Status
	\|- Number of jail: 1		\|- Number of jail: 1
	`- Jail list: mdmjail		`- Jail list: mdmjail