Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We all know that in fail2ban after reading one log file it will wait for 1 second.the problem is that during that waiting time the attacker make lots of attack. so how can we remove this waiting time?or any other alternative of fail2ban ,that will provide this much facility than fail2ban.

share|improve this question
add comment

1 Answer

I don't know if it is wise to remove the waiting period. This will put more stress on your system.

If you want an alternative have a look at OSSEC. On my blog (link in my profile) you can find a post on what it does and how it works. It's very tweakable.

share|improve this answer
    
Is OSSEC work better or same as fail2ban?because i dont know about OSSEC but fail2ban work very nice that is know. –  jagruti Mar 15 '12 at 11:07
    
I explain it here quite extensive : cloud101.eu/blog/2012/03/01/… It has more options than fail2ban. I prefer it over fail2ban because I can use it distributed over multiple machines. If one machine detects an intrusion attempt, all the other hosts are notified about this. –  Lucas Kauffman Mar 15 '12 at 11:19
    
i have install the OSSEC as per steps given in documentation.but confution is that in that server,local and agent 3 are given so all 3 are install or specific any –  jagruti Mar 20 '12 at 10:32
    
i have install all 3 but there is no any agent in active state shown me.and how can i know wether it is work perfectly now. –  jagruti Mar 20 '12 at 10:33
    
You install 1 server and the rest are agents... –  Lucas Kauffman Mar 20 '12 at 11:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.