I have a docker container running a password authenticated SFTP server (client requirement - I've already lost that battle). In order to mitigate the risk of brute force attacks, I had thought to install iptables and fail2ban within the container. However, to get iptables working this requires that I allow the container NET_ADMIN rights.
I've not been able to find from the Docker documentation whether this allows the container simply to make changes to it's own network, or to amend the host network as well. All I have found is a summary, such as:
Capability Key | Capability Description
---------------|-----------------------
NET_ADMIN | Perform various network-related operations.
Reading the MAN pages linked from the Docker documentation provides a list of the capabilities that this imparts, but of course it's not written in the context of Docker ...
Perform various network-related operations:
- interface configuration;
- administration of IP firewall, masquerading, and accounting
- modify routing tables;
- bind to any address for transparent proxying;
- set type-of-service (TOS)
- clear driver statistics;
- set promiscuous mode;
- enabling multicasting;
... so I'm still unclear whether these abilities are granted at host level, or relates only to the container's network. An alternative strategy I'd come up with was to expose the container's auth.log using a shared volume and have fail2ban run on the host (I'd obviously have to set --iptables=false on the Docker engine), but I preferred the neatness of having no external host dependency and everything within a single container.
Can anyone allay my fears, or provide alternatives?