Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I use fail2ban to prevent brute force attacks on my production servers. Fail2ban bans an ip after 5 authentication failure and unbans it after 1 hour with my own configuration. I wonder that what is the optimum ban duration or do i really need to unban it again? Is banning an ip permanently the best solution?

share|improve this question

2 Answers 2

up vote 4 down vote accepted

There is no general rule for the optimum time of a ban, it depends on a lot of factors including

  • The type of server/service
  • The target audience
  • The type of attack
  • and the the specific attack/attacker.

This is of course also true to decide if you need to unban at all - if very few IP addresses might legitimately connect to your services, banning attackers (semi) permanently might not be a bad idea, but in other cases, this will create more problems than doing good.

Edit regarding your comment:

The most important protection for root accounts is to

  • don't allow root access to begin with
  • Use only key-based login for the other uses and disallow passwords.

This also helps to protect you against the distributed type of brute-force attack you can see today where you are slowly attacked by a great number of bot net machines with each machine trying only a very small number of passwords, thus not triggering stuff like fail2ban at all.

2nd edit, regarding 2nd comment:

We are clearly in the "it depends" territory here. An example from my environments:

  • Machine 1 has users logging in from external networks. I can't disable password logins (because of reasons :( ). Ban time is set to 10 minutes.
  • Machine 2 has only admins logging in from very few, slowly changing IPs. Ban time is set to 24h.

The thing is that the 24h ban works only marginally better, if at all (*), but machine 2 is much better protected nevertheless due to the restriction to non-root key based logins.

(*) This is my impression and is not founded in any real statistical analysis of log files.

share|improve this answer
    
I want to prevent root login brute force attacks on SSH service without make changes on default ssh service configuration. –  efesaid Jul 21 at 12:14
    
@efesaid: See my edit. –  Sven Jul 21 at 12:33
    
Thanks for answer. If i don't want to change any option in default ssh configuration (such as Port,PermitRootLogin and PasswordAuthentication) ? I am trying to figure out differences between banning permanently and for a while on ssh service? –  efesaid Jul 21 at 12:52

It's not good behavior to banning IP forever, because of any harmless connection takes that IP in any time.

I generally prefer a day for optimal ban time span. This approach provides protection for taking attacks from same IP for a day. If you still get attacks from same IP You can ban it for a month manually.

share|improve this answer
1  
What is your reasoning to claim that "one day is the the optimal time span"? –  Sven Jul 21 at 11:58
    
Ain't no body have much time for that :) –  Sencer H. Jul 21 at 12:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.