Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

On my LAMP servers, do either of the firewall interfaces (ufw or apt) allow you to setup rate limiting to automatically ban brute force attempts (e.g. via SSH)? Or, is it best to install fail2ban in conjunction with strict firewall rules?

share|improve this question

3 Answers 3

up vote 4 down vote accepted

For ufw look into the limit command.

sudo ufw limit ssh

From the ufw man page section on the limit command:

RULE SYNTAX
   [...]

   ufw supports connection rate limiting, which is useful  for  protecting
   against  brute-force  login attacks. ufw will deny connections if an IP
   address has attempted to initiate 6 or more connections in the last  30
   seconds.    See  http://www.debian-administration.org/articles/187  for
   details.  Typical usage is:

     ufw limit ssh/tcp
share|improve this answer
    
Is this the same functionality of fail2ban's ssh jail? –  Trent Scott Apr 3 '12 at 5:01
    
@TrentScott Don't know. I don't use fail2ban. –  Wesley Apr 3 '12 at 6:01
    
That's alright. Thanks for your answer! –  Trent Scott Apr 3 '12 at 6:18

I ALWAYS recommend spending the time to learn how the firewall rules work.

UFW may meet your needs today but it's limited, and it may not do what you need tomorrow and you need it RIGHT NOW.

Spend some quality time with some webpages talking about IPTables (properly called NetFilter). It's time well spent if your setup will be growing in complexity or scope in the future.

share|improve this answer

ufw is not more than an interface to manage netfilter rules. From man ufw, you can read:

ufw - program for managing a netfilter firewall

Several netfilter modules can be used to implement different security measures. Have a look at this page. You can see limit and iplimit modules. You can find also recent module.

Fail2ban is nice as it allows you to block some IPs by modifying your firewall rules. It can scan log files to detect breaking attempts. Also, it can be configured to do an arbitrary action such as alerting you and/or executing some script, etc...

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.