On my LAMP servers, do either of the firewall interfaces (ufw or apt) allow you to setup rate limiting to automatically ban brute force attempts (e.g. via SSH)? Or, is it best to install fail2ban in conjunction with strict firewall rules?
ufw look into the
sudo ufw limit ssh
ufw man page section on the
RULE SYNTAX [...] ufw supports connection rate limiting, which is useful for protecting against brute-force login attacks. ufw will deny connections if an IP address has attempted to initiate 6 or more connections in the last 30 seconds. See http://www.debian-administration.org/articles/187 for details. Typical usage is: ufw limit ssh/tcp
I ALWAYS recommend spending the time to learn how the firewall rules work.
UFW may meet your needs today but it's limited, and it may not do what you need tomorrow and you need it RIGHT NOW.
Spend some quality time with some webpages talking about IPTables (properly called NetFilter). It's time well spent if your setup will be growing in complexity or scope in the future.
ufw is not more than an interface to manage netfilter rules. From
man ufw, you can read:
ufw - program for managing a netfilter firewall
Several netfilter modules can be used to implement different security measures. Have a look at this page. You can see
iplimit modules. You can find also
Fail2ban is nice as it allows you to block some IPs by modifying your firewall rules. It can scan log files to detect breaking attempts. Also, it can be configured to do an arbitrary action such as alerting you and/or executing some script, etc...