Fail2ban: Difference between revisions
No edit summary |
No edit summary |
||
| Line 19: | Line 19: | ||
* Check out port knocking on a non-default port | * Check out port knocking on a non-default port | ||
* check out [https://github.com/denyhosts/denyhosts denyhosts] | * check out [https://github.com/denyhosts/denyhosts denyhosts] | ||
* turn off passwords entirely! | * turn off passwords entirely! | ||
** make sure to set up juicessh with the key | |||
** make sure you have a script you can run from bitpost to temporarily turn it back on to set up new machines, run from phone and then start a cron job to turn it off in x minutes | |||
* deep dive into how to set up a truly painful tarpit for attackers | * deep dive into how to set up a truly painful tarpit for attackers | ||
Revision as of 13:48, 30 November 2017
fail2ban watches log files for misbehavior, and creates firewall rules, to stop things like brute force ssh attempts.
It takes a few commands to get going though, and I guess it doesn't run as a normal service?
🌵 m@bitpost [~]sudo fail2ban-client add mdmjail Added jail mdmjail 🌵 m@bitpost [~] sudo fail2ban-client start mdmjail Jail started 🌵 m@bitpost [~] sudo fail2ban-client set mdmjail addlogpath /var/log/messages Current monitored log file(s): `- /var/log/messages 🌵 m@bitpost [~]sudo fail2ban-client status Status |- Number of jail: 1 `- Jail list: mdmjail
Still not working yet...
- Check out port knocking on a non-default port
- check out denyhosts
- turn off passwords entirely!
- make sure to set up juicessh with the key
- make sure you have a script you can run from bitpost to temporarily turn it back on to set up new machines, run from phone and then start a cron job to turn it off in x minutes
- deep dive into how to set up a truly painful tarpit for attackers