Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Using fail2ban to secure an Ubuntu 12.04 x64 Server on DigitalOcean, while editing /etc/fail2ban/jail.local there's this part:

[DEFAULT]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host
ignoreip = 127.0.0.1/8

That is the IP that admin will be connecting from but is there any solution if the admin has a dynamic IP?
Or does that simply defeat the purpose?

share|improve this question
1  
Yes, it defeats the purpose. fail2ban bans people after X number of unsuccesful logins. –  SpacemanSpiff Feb 16 '13 at 20:41

2 Answers 2

up vote 2 down vote accepted

If admins will be connecting from dynamic IPs I can think of 3 different options:

  1. If a range of those dynamic IP is known and small enough, add that.
  2. Have your admins setup Dynamic DNS hostnames pointing to their current IPs and add those hostnames to this ignore list.
  3. Make sure your admins don't have butterfingers and can properly type in their passwords. :) Or better yet setup private/public ssh keys.
share|improve this answer

At most you could whitelist the IP range your admin is in, but then you're vulnerable to attacks from that range. It'd still help (most brute force comes from other countries/ISPs), but not ideal.

If it only bans after say, 5 incorrect attempts, is it really a problem? How often is your admin going to lock themselves out? If they can't remember passwords, you could maybe look at SSH keys?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.