Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm setting up a LAMP server and need to prevent SSH/FTP/etc. brute-force logon attempts from succeeding. I've seen many recommendations for both denyhosts and fail2ban, but few comparisons of the two. I also read that an IPTables rule can fill the same function.

Why would I choose one of these methods over another? How do people on serverfault handle this problem?

share|improve this question
add comment

4 Answers

up vote 15 down vote accepted

IIRC, DenyHosts will only watch your SSH service. If you need it to protect other services as well, Fail2ban is definitely a better choice. It is configurable to watch nearly any service if you are willing to tweak its configuration, but that shouldn't be necessary as the newer versions of Fail2ban include rulesets which are suitable for many popular server daemons. Using fail2ban over a simple iptables rate limit has the advantage of completely blocking an attacker for a specified amount of time, instead of simply reducing how quickly he can hammer your server. I've used fail2ban with great results on a number of production servers and have never seen one of those servers breached by a brute force attack since I've started using it.

share|improve this answer
    
Note that DenyHosts will infact block other services - the main difference is that fail2ban uses iptables whereas DenyHosts uses hosts.deny, some services don't look at the hosts files such as Apache. –  jammypeach Feb 6 '13 at 11:57
    
To throw another option onto the table, I recently discovered that the ufw firewall configurator also allows you to apply an (unconfigurable) rate limit to any TCP or UDP port. If you're already using UFW, this could be a good option, instead of configuring and running an additional daemon. –  spiffytech Feb 28 '13 at 3:36
add comment

I use iptables rules to rate-limit new connections from the same IP address (SSH mainly, but it'd work fine for FTP, too). The advantage, as I see it, over "fail2ban" and other such tools is that the iptables route occurs totally in kernel mode and doesn't rely on any user mode tools to tail / parse log files.

http://serverfault.com/questions/17870/hundreds-of-failed-ssh-logins/17879#17879

If you can do it, limiting the source addresses that can access the protcols in question will, obviously, help as well.

With SSH, you really should be using certificate authentication and not accepting passwords anyway.

share|improve this answer
    
nice new icon dude –  Chopper3 Apr 4 '10 at 17:41
    
>smile< We'll see how long my unicorn will stay around... –  Evan Anderson Apr 5 '10 at 15:54
add comment

One thing to note about Fail2Ban is that it seems to use about 10MB more memory than DenyHosts. So if you are on a 128MB VPS you might want to look into that. Also, out-of-the-box fail2ban is only setup on SSH which means that with no changes to the config - DenyHosts does the same thing in less memory.

share|improve this answer
1  
Try appending "ulimit -s 256" to /etc/default/fail2ban. Lowered 10MB on my system. –  pkoch Dec 17 '12 at 4:15
add comment

denyhosts is for ssh. fail2ban is more comprehensive (HTTP, FTP, etc.). Both use iptables behind the scenes.

share|improve this answer
    
Both "denyhosts" and "fail2ban" use iptables to accomplish their "blocking" behaviour, but they don't use iptables to rate-limit. They parse logs in "user land" and act upon log entries. –  Evan Anderson Apr 3 '10 at 1:14
8  
@Evan, denyhosts does not use iptables (by default). It uses TCP wrappers and updates your /etc/hosts.deny when a system is to be banned. –  Zoredache Apr 3 '10 at 2:05
    
............... –  Chopper3 Apr 4 '10 at 17:40
    
@Zoredache: I stand corrected. Having enver used "denyhosts" before, I made an incorrect assumption about how it invokes its "blocking" functionality. Still, being a userland log-parsing / reaction tool, I'd prefer using a strictly iptables-based solution to "denyhosts". –  Evan Anderson Apr 5 '10 at 15:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.