I have firewall rules set up and also denyhosts installed. do I also need to install fail2ban?


Denyhosts protects only ssh; Fail2Ban protects all daemons.


Yes, why not; fail2ban is very nice software. Fail2ban is a very good firewall for bruteforce attacks, on ftp, ssh, mail server and etc.

  • I'm no expert on either, but I agree that fail2ban seems to secure more daemons than denyhosts, which is ssh-specific. Ntrance, please don't take this the wrong way, but could you maybe type a little slower? I understand that English may well not be your primary language, but it often isn't the primary language of people asking the questions either, and your answers will be easier for them to understand and appreciate if they don't have to decode them first. This is the second of your answers I've tidied up this morning.
    – MadHatter
    Dec 4 '10 at 9:39
  • Yes i know about my english ;( and sorry for that . But my technical skills is very good. Maybe here i will take good experience for my english.
    – ntrance
    Dec 4 '10 at 9:54

No. Denyhosts and fail2ban serve the same purpose, by different means.

  • This is wrong, they are not. Fail2ban controls more than just ssh. Jul 21 '12 at 13:27

fail2ban is neither necessary nor sufficient for system security. It may make bosses and auditors feel better, but a well-configured system should be perfectly secure with brute force attacks bouncing harmlessly off of them. It's also been exploited in the past to lock legitimate users out of their systems.

  • 1
    -1 Can you qualify this further? Is there not a risk of Denial of Service from brute force attacks that fail2ban reduces?
    – dunxd
    Dec 29 '10 at 10:30
  • 1
    fail2ban isn't designed to protect against DoS attacks. It may help slightly by reducing CPU overhead from key exchange in SSH sessions, but you'd need hundreds of attackers for that to be an issue given the built-in throttling that sshd uses, and those attackers could do a lot more damage with TCP attacks that fail2ban can't do anything about.
    – Chris
    Jan 6 '11 at 17:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy