2

Using fail2ban to secure an Ubuntu 12.04 x64 Server on DigitalOcean, while editing /etc/fail2ban/jail.local there's this part:

[DEFAULT]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host
ignoreip = 127.0.0.1/8

That is the IP that admin will be connecting from but is there any solution if the admin has a dynamic IP?
Or does that simply defeat the purpose?

1
  • 1
    Yes, it defeats the purpose. fail2ban bans people after X number of unsuccesful logins. Feb 16, 2013 at 20:41

3 Answers 3

5

If admins will be connecting from dynamic IPs I can think of 3 different options:

  1. If a range of those dynamic IP is known and small enough, add that.
  2. Have your admins setup Dynamic DNS hostnames pointing to their current IPs and add those hostnames to this ignore list.
  3. Make sure your admins don't have butterfingers and can properly type in their passwords. :) Or better yet setup private/public ssh keys.
5

At most you could whitelist the IP range your admin is in, but then you're vulnerable to attacks from that range. It'd still help (most brute force comes from other countries/ISPs), but not ideal.

If it only bans after say, 5 incorrect attempts, is it really a problem? How often is your admin going to lock themselves out? If they can't remember passwords, you could maybe look at SSH keys?

0

Fail2ban is an intrusion prevention software framework which protects computer servers from brute-force attacks. - Wikipedia

The ignoreip option is not for admin connections, and should be used wisely. For example in private networks where you are in a different VLAN that the rest of the users, but even then it should not be considered (what if an attacker is in your VLAN?).

If you know the password of the server then you won't ban yourself, but if you fail 3 times (or the maxretry configured) then try again later (bantime seconds).

I strongly recommend using an SSH key since are more secure. And test your configuration to know that is working good trying invalid users, invalid passwords, etc. (yes that means ban yourself).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .