Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

I have firewall rules set up and also denyhosts installed. do I also need to install fail2ban?

share|improve this question

4 Answers

up vote 4 down vote accepted

Denyhosts protects only ssh; Fail2Ban protects all daemons.

share|improve this answer
up vote 1 down vote

Yes, why not; fail2ban is very nice software. Fail2ban is a very good firewall for bruteforce attacks, on ftp, ssh, mail server and etc.

share|improve this answer
I'm no expert on either, but I agree that fail2ban seems to secure more daemons than denyhosts, which is ssh-specific. Ntrance, please don't take this the wrong way, but could you maybe type a little slower? I understand that English may well not be your primary language, but it often isn't the primary language of people asking the questions either, and your answers will be easier for them to understand and appreciate if they don't have to decode them first. This is the second of your answers I've tidied up this morning. – MadHatter Dec 4 '10 at 9:39
Yes i know about my english ;( and sorry for that . But my technical skills is very good. Maybe here i will take good experience for my english. – ntrance Dec 4 '10 at 9:54
up vote 0 down vote

No. Denyhosts and fail2ban serve the same purpose, by different means.

share|improve this answer
This is wrong, they are not. Fail2ban controls more than just ssh. – Lucas Kauffman Jul 21 '12 at 13:27
up vote -1 down vote

fail2ban is neither necessary nor sufficient for system security. It may make bosses and auditors feel better, but a well-configured system should be perfectly secure with brute force attacks bouncing harmlessly off of them. It's also been exploited in the past to lock legitimate users out of their systems.

share|improve this answer
1  
-1 Can you qualify this further? Is there not a risk of Denial of Service from brute force attacks that fail2ban reduces? – dunxd Dec 29 '10 at 10:30
1  
fail2ban isn't designed to protect against DoS attacks. It may help slightly by reducing CPU overhead from key exchange in SSH sessions, but you'd need hundreds of attackers for that to be an issue given the built-in throttling that sshd uses, and those attackers could do a lot more damage with TCP attacks that fail2ban can't do anything about. – Chris Jan 6 '11 at 17:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.