Comment on Analyzing the attacks on my websiteparentComments−bdamm6yfail2ban is saving my bacon right now.−ryanlol6yFrom what? Generally fail2ban only exposes unnecessary attack surface while providing zero benefit.−omgwtfbyobbq6yHow does fail2ban expose attack surface?−detaro6yIt's code running on partially attacker-controlled inputs. It several times had vulnerabilities that allowed an attacker to trigger blocks for arbitrary IPs.−cyc1156yI remember there's a privEsc on old versions of fail2ban.−omgwtfbyobbq6yDo you remember roughly when the privEsc was?https://www.cvedetails.com/vulnerability-list/vendor_id-5567...−ryanlol6ySketchy parsers operating on untrusted, unstructured log data.fail2ban is worse than useless.
Comments
fail2ban is saving my bacon right now.
From what? Generally fail2ban only exposes unnecessary attack surface while providing zero benefit.
How does fail2ban expose attack surface?
It's code running on partially attacker-controlled inputs. It several times had vulnerabilities that allowed an attacker to trigger blocks for arbitrary IPs.
I remember there's a privEsc on old versions of fail2ban.
Do you remember roughly when the privEsc was?
https://www.cvedetails.com/vulnerability-list/vendor_id-5567...
Sketchy parsers operating on untrusted, unstructured log data.
fail2ban is worse than useless.