From: Pascal Hambourg <pascal.mail@plouf.fr.eu.org>
To: netfilter@vger.kernel.org
Subject: Re: can we design a modified fail2ban ?
Date: Fri, 16 Apr 2010 17:29:43 +0200 [thread overview]
Message-ID: <4BC88267.5010005@plouf.fr.eu.org> (raw)
In-Reply-To: <4BC7E028.8050209@infoservices.in>
Hello,
J. Bakshi a écrit :
>
> fail2ban is a popular application to prevent the brute-force attack
> against ssh and also against imap, pop3 etc.. But fail2ban actually
> blacklist the IP and this is what fail2ban has been designed for. Now a
> days we can design the same with iptables. I wonder if iptables can
> provide more liberty to match IP as well as port combination so that we
> don't need to blacklist the IP but only block the attempts from the IP
> based on port. Say more than 3 ssh attempt from IP xxx.xxx.xxx.xxx is
> detected and no more ssh attempt from the same ip is no more possible
> but pop and imap still works. Is it really possible with iptables ?
Detected how ? fail2ban detects authentication failures by parsing the
server logs. iptables cannot do this, and IHMO should not do this. This
is just not its purpose.
prev parent reply other threads:[~2010-04-16 15:29 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-04-16 3:57 can we design a modified fail2ban ? J. Bakshi
2010-04-16 7:28 ` Jan Engelhardt
2010-04-17 16:01 ` Alessandro Vesely
2010-04-17 17:58 ` Jan Engelhardt
2010-04-18 13:46 ` Alessandro Vesely
2010-04-18 16:44 ` Jan Engelhardt
2010-04-19 15:18 ` Alessandro Vesely
2010-04-19 3:16 ` J. Bakshi
2010-04-16 15:29 ` Pascal Hambourg [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4BC88267.5010005@plouf.fr.eu.org \
--to=pascal.mail@plouf.fr.eu.org \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox