8

I’m setting up a Debian VPS on Linode to use as a public web server, and I’m following their security suggestions.

The last suggestion they make is to install fail2ban, to avoid dictionary attacks on the server. They mention that by default it only monitors SSH login attempts.

However, in a previous step, they suggested turning off SSH password login (which I did). Given that I’ve done this, does using fail2ban for SSH connections add any security?

Improve this question

1 Answer 1

Reset to default
8

Even though password brute force attempts may not be successful on your system, using fail2ban has other benefits than simply blocking the attack:

  1. Keeps your auth log from filling up too much, saving disk space and making analysis easier.
  2. Reduces unnecessary CPU cycles and bandwidth servicing bruteforce attempts.

fail2ban is a great tool for more than just protecting SSH, too. You can use it to monitor any kind of log, and take actions besides just blocking. For instance, you can have it watch for too many downloads of large files from your web server, then throttle the connection and notify you by email.

Improve this answer
2
  • Sure — I did wonder whether the other things it can protect were the reason for Linode recommending it. I’m not actually planning to have anything else on the server that folks could log into in the immediate future. Good point on the other benefits.
    – Paul D. Waite
    May 10, 2013 at 15:12
  • fail2ban is a general-enough framework that you can use it to automate any log-checking function. Email you any time your app throws an exception. Restart a service if it logs low-memory errors. Sky's the limit!
    – bonsaiviking
    May 10, 2013 at 18:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .