7

I saw that while I was creating my AWS instance I opted for only my IP address being able to access my server. Also There is a RSA key that is configured for you. In this case do I really need fail2ban installed on the server?

3
  • 3
    I like the accepted answer, but I'll note that fail2ban won't hurt, and having it in place now means if you ever open it up to the world you don't have to remember that you don't have fail2ban installed.
    – ceejayoz
    Apr 20, 2016 at 13:46
  • Ceejayoz, you bring up a good point. I have two concerns with installing fail2ban preemptively: 1. if the host is opened up to the Internet then the rules will still have to be tested to ensure they work properly, and that banning works correctly. You may as well install it fresh and do that work when you need it. 2. Given that the only IP that has access to the host is the OP's fail2ban might block it (due to misconfiguration of ignoreip etc). In this situation the ROI for adding fail2ban early is low.
    – prateek61
    Apr 21, 2016 at 11:47
  • You still need fail2ban with RSA, otherwise you will have lots of logs of scan brute force attacks. Although they do not work anymore, they are still logged. Nevertheless, I do prefer not to expose ssh in the Internet. Have a look at my answer here. security.stackexchange.com/questions/110706/… Apr 28, 2016 at 20:56

5 Answers 5

2

In that case, I would say that fail2ban would not be required.

I would really only use fail2ban when you have to expose a management service to the Internet in the hypervisor (aws) firewall. In your case, all requests except those from your IP are being dropped.

One thing to note, if your IP address changes (non-static) you will have to update the aws security group.

0
3

All the answers saying fail2ban is unnecessary because of the AWS security policies, effectively another firewall. However, if that ever fails or becomes misconfigured, then attacks can come in. A combination of iptables/firewalld/ufw and fail2ban makes complete sense, and layered security is an important tactic. So fail2ban (along with basic firewall configuration) is still a good idea.

I want to add as @tim has mentioned, that fail2ban (and other kinds of similar tools) can provide more granularity than AWS security policies, which seem to be limited to protocols and ip address ranges. For example, aggressive spiders can be blocked, as well as bots that try and login. Blocking at the network layer is more efficient than the web server, or the web application (e.g., Wordpress) layer.

1
  • I agree. Fail2ban helps protect against application level attacks, such as Wordpress vulnerabilities. I have fail2ban detecting these attacks then adding the IPs to the CloudFlare firewall. Instructions here.
    – Tim
    Aug 23, 2017 at 5:02
2

Fail2ban scans log files for potentially malicious actions and bans the IP-addresses from which such behaviour originates. Generally Fail2Ban is then used initiate an action that will block subsequent (malicious) actions from that IP-address from recurring.

To prevent getting locked out as an administrator you would normally add your own (management) network addresses to an IP-whitelist in fail2ban.

Now if your server or service has been firewalled to only allow access from the same ip-addresses and/or networks present in that whitelist, fail2ban will never actually do anything, right?

0
1

The advantage of using the AWS firewall from Fail2ban is API. With the help of API you can centrally and automatically manage your firewall rules on a large number of instances, with fail2ban this will make it much more difficult.

1
  • Don't see how this matters, since fail2ban blocks ips that have had repeated failed logins. It should not affect ips that carry out valid login requests. Aug 6, 2022 at 15:03
0

The only reason I would add fail2ban in your case would be to DROP kids trying to connect on the server indefinitely and limit the responses it serves for nothing (in the case your server does generate REJECT answers to those trying to connect).

Now, you might have a good reason to whitelist IPs but on SSH is fairly secure, as long as you keep your key private (and disable root login is best). Also, it is quite easy to setup 2 factor authentication on ssh (e.g. using Google 2FA), using your password and a 'random' generated number. Whitelisting an IP for ssh might just become unpractical at some point !

3
  • 1
    If OP has restricted their security groups to just their IP (that's how I read the question) there won't be any connection attempts that make it to the server - they'll be stopped at the AWS network/firewall level.
    – ceejayoz
    Apr 20, 2016 at 14:51
  • That is what I was expecting with AWS (and there, fail2ban is useless) but I don't know how they proceed with their firewall policies. That's something quite unclear I think in general with 'cloud' providers.
    – Bamse
    Apr 20, 2016 at 18:27
  • i second 2FA, however I do prefer to setup VPNs entry points, and only allow ssh through a VPN. Have a look at strongswan. Apr 28, 2016 at 21:03

You must log in to answer this question.