On my LAMP servers, do either of the firewall interfaces (ufw or apt) allow you to setup rate limiting to automatically ban brute force attempts (e.g. via SSH)? Or, is it best to install fail2ban in conjunction with strict firewall rules?
3 Answers
For ufw
look into the limit
command.
sudo ufw limit ssh
From the ufw
man page section on the limit
command:
RULE SYNTAX
[...]
ufw supports connection rate limiting, which is useful for protecting
against brute-force login attacks. ufw will deny connections if an IP
address has attempted to initiate 6 or more connections in the last 30
seconds. See http://www.debian-administration.org/articles/187 for
details. Typical usage is:
ufw limit ssh/tcp
I ALWAYS recommend spending the time to learn how the firewall rules work.
UFW may meet your needs today but it's limited, and it may not do what you need tomorrow and you need it RIGHT NOW.
Spend some quality time with some webpages talking about IPTables (properly called NetFilter). It's time well spent if your setup will be growing in complexity or scope in the future.
ufw
is not more than an interface to manage netfilter rules. From man ufw
, you can read:
ufw - program for managing a netfilter firewall
Several netfilter modules can be used to implement different security measures. Have a look at this page. You can see limit
and iplimit
modules. You can find also recent
module.
Fail2ban is nice as it allows you to block some IPs by modifying your firewall rules. It can scan log files to detect breaking attempts. Also, it can be configured to do an arbitrary action such as alerting you and/or executing some script, etc...