fail2ban best method of blocking brute force attempts?

mrtwice · 12-09-2008, 08:11 AM

Just about everyday I get stuff like this in my logwatch email:

Code:

    dovecot[3330]: auth(default): shadow(willy,190.172.84.80): unknown user: 1 Time(s)
    dovecot[3330]: auth(default): shadow(willy,200.81.220.62): unknown user: 1 Time(s)
    dovecot[3330]: auth(default): shadow(wilson,190.172.84.80): unknown user: 2 Time(s)
    dovecot[3330]: auth(default): shadow(winston,190.172.84.80): unknown user: 1 Time(s)
    dovecot[3330]: auth(default): shadow(winston,200.81.220.62): unknown user: 1 Time(s)
    dovecot[3330]: auth(default): shadow(www,190.172.84.80): unknown user: 1 Time(s)
    dovecot[3330]: auth(default): shadow(www,200.81.220.62): unknown user: 1 Time(s)
    dovecot[3330]: auth(default): shadow(xavier,190.172.84.80): unknown user: 1 Time(s)
    dovecot[3330]: auth(default): shadow(xavier,200.81.220.62): unknown user: 1 Time(s)
    dovecot[3330]: auth(default): shadow(zachary,190.172.84.80): unknown user: 2 Time(s)
    dovecot[3330]: auth(default): shadow(zack,190.172.84.80): unknown user: 1 Time(s)
    dovecot[3330]: auth(default): shadow(zack,200.81.220.62): unknown user: 1 Time(s)

I also get stuff like this:

Code:

(amrbekbmr.com) [114.44.147.232]: 535 Incorrect authentication data (set_id=inna): 1 Time(s)
 2008-12-06 14:42:24 login authenticator failed for 114-44-147-232.dynamic.hinet.net (gdpipenv.com) [114.44.147.232]: 535 Incorrect authentication data (set_id=inna): 1 Time(s)
 2008-12-06 14:42:25 login authenticator failed for 114-44-147-232.dynamic.hinet.net (gdpipenv.com) [114.44.147.232]: 535 Incorrect authentication data (set_id=inna): 1 Time(s)
 2008-12-06 14:42:27 login authenticator failed for 114-44-147-232.dynamic.hinet.net (gdpipenv.com) [114.44.147.232]: 535 Incorrect authentication data (set_id=inna): 1 Time(s)
 2008-12-06 14:42:29 login authenticator failed for 114-44-147-232.dynamic.hinet.net (gdpipenv.com) [114.44.147.232]: 535 Incorrect authentication data (set_id=inna): 1 Time(s)

I did a some looking on this forum and saw a post on fail2ban, which looks promising. But I wondering if there is a better/more preferred way of dealing with this stuff.

Thanks.

acid_kewpie · 12-09-2008, 10:01 AM

fail2ban is nice certainly, but does build up potentially large iptables rules if that's an issue for you. You can have simpler methods using the iptables limit module to only allow so many connections in a given time and then block them out if that's exceeded, which is non-persistent but pretty effective.

acid_kewpie · 12-09-2008, 10:01 AM

fail2ban is nice certainly, but does build up potentially large iptables rules if that's an issue for you. You can have simpler methods using the iptables limit module to only allow so many connections in a given time and then block them out if that's exceeded, which is non-persistent but pretty effective.

http://kevin.vanzonneveld.net/techbl...with_iptables/

mrtwice · 12-09-2008, 10:52 AM

Quote:

Originally Posted by acid_kewpie

fail2ban is nice certainly, but does build up potentially large iptables rules if that's an issue for you. You can have simpler methods using the iptables limit module to only allow so many connections in a given time and then block them out if that's exceeded, which is non-persistent but pretty effective.

http://kevin.vanzonneveld.net/techbl...with_iptables/

Good read, thanks for the info and link.