toad.social

Dave RobinsonDon't believe everything you find on the Internet. Even well-intended stuff can contain serious flaws... I was wondering why my <a href="https://europhiles.uk/tags/gotosocial" class="mention hashtag" rel="nofollow noopener" target="_blank">#GoToSocial</a> Fediverse feed was a bit quiet, and why no one was engaging with any of my posts. I assumed it was because I had nothing useful to say, as usual. However, it turned out that over the past week or so the <a href="https://europhiles.uk/tags/fail2ban" class="mention hashtag" rel="nofollow noopener" target="_blank">#Fail2Ban</a> regex I'd added was quietly and steadily blocking other ActivityPub servers. The lights were going out! I have now concocted my own regular expression based on the official documentation ( <a href="https://docs.gotosocial.org/en/v0.19.1/advanced/security/firewall/" rel="nofollow noopener" target="_blank">https://docs.gotosocial.org/en/v0.19.1/advanced/security/firewall/</a>), but adapted to cope with the JSON logs generated by Caddy. That will teach me to be lazy.

Elena Rossini on GoToSocial ⁂Me right now: studying the ins and outs of <a href="https://aseachange.com/tags/docker" class="mention hashtag" rel="nofollow noopener" target="_blank">#Docker</a>, ports exposure, firewalls and <a href="https://aseachange.com/tags/tls" class="mention hashtag" rel="nofollow noopener" target="_blank">#TLS</a>.I’ve got a brand new VPS (on Hetzner) that for now only has <a href="https://aseachange.com/tags/fail2ban" class="mention hashtag" rel="nofollow noopener" target="_blank">#Fail2Ban</a> on it.Let’s see when I’ll feel confident (reckless?) enough to install <a href="https://aseachange.com/tags/docker" class="mention hashtag" rel="nofollow noopener" target="_blank">#Docker</a> on it 😅This time I learned my lesson and I’m only paying month-by-month. And I’ve got many thoughts about what went down yesterday that I may share in a blog post soon.Thanks for all your supportive messages ❤️ I hope my public fumbles are useful to fellow <a href="https://aseachange.com/tags/selfhosting" class="mention hashtag" rel="nofollow noopener" target="_blank">#selfhosting</a> newbies 🥲<a href="https://aseachange.com/tags/mysocalledsudolife" class="mention hashtag" rel="nofollow noopener" target="_blank">#MySoCalledSudoLife</a> <a href="https://aseachange.com/tags/sudomaimparo" class="mention hashtag" rel="nofollow noopener" target="_blank">#SudoMaImparo</a>

Elena Rossini on GoToSocial ⁂:alert: MAJOR Plot twist! :FireDumpster: I'm sure you're having a better morning than me because I was greeted with an email from <a href="https://aseachange.com/tags/ovh" class="mention hashtag" rel="nofollow noopener" target="_blank">#OVH</a> (the VPS provider) that started with "Hello Mr. Rossini" and informed me that the VPS was stopped because they suspected a hack - and it will be permanently deleted. "Now let us know Mr. Rossini if you'd like to purchase a new VPS plan." 30 Euros* for 4 hours of VPS experimentation with Docker! YAY (not!) (*30 Euros corresponded to a 6-month plan, sigh) I received ZERO advanced warnings... <a href="https://aseachange.com/tags/ovhcloud" class="mention hashtag" rel="nofollow noopener" target="_blank">#OVHCloud</a> simply deleted my VPS because of "unusual activity" and proposed I buy a new one. I had installed <a href="https://aseachange.com/tags/fail2ban" class="mention hashtag" rel="nofollow noopener" target="_blank">#Fail2Ban</a> on it first thing yesterday morning, but I suppose changing 0.0.0.0 with my VPS's IP4 address in one of the Docker settings... to connect it to Docker GUI did it for me. You live, you learn. I will stay away from OVH Cloud. (Yes I had tried creating an account with Hetzer and NetCup before but they had a convoluted signup process and wanted too much personal info/docs, so I had given up and turned to OVH. My bad). What will I do now? Find a new VPS provider. Feeling salty about the 30 Euros I spent for 6 months with OVH but honestly I feel like I dodged a bullet. I had nothing installed on the VPS, except for Fail2Ban and basic Docker. Imagine how catastrophic it would have been if they had deleted my VPS without warning if I had important stuff on it! Shivering at the thought. Onwards and upwards, more humble than ever, with infinite respect for sysadmins 🙏 <a href="https://aseachange.com/tags/mysocalledsudolife" class="mention hashtag" rel="nofollow noopener" target="_blank">#MySoCalledSudoLife</a> <a href="https://aseachange.com/tags/n00b" class="mention hashtag" rel="nofollow noopener" target="_blank">#N00b</a>

Elena Rossini on GoToSocial ⁂Dear Fedi friends, Sometimes it's good to know when you need to call it a day. Today I ended my <a href="https://aseachange.com/tags/sudo" class="mention hashtag" rel="nofollow noopener" target="_blank">#sudo</a> exploits at 10:00am... I'm mentally exhausted already... but happy about the progress I made. I started tinkering with my new VPS at 7:30am and managed the following tasks: - installed <a href="https://aseachange.com/tags/fail2ban" class="mention hashtag" rel="nofollow noopener" target="_blank">#fail2ban</a> - installed <a href="https://aseachange.com/tags/docker" class="mention hashtag" rel="nofollow noopener" target="_blank">#Docker</a> and checked if it was running successfully with their "hello world" method (it does) - enabled remote access changing the listening port - secured the connection with TLS I wasn't able to create a new Docker context on Docker Desktop to point to my VPS... I ran into error messages about having to include certificates (with the right path)... so I decided to call it a day. I wanted to end my Day 1 of Docker explorations on a good note. I plan on writing about this on my blog later today so I can refer back to the steps later... when I actually install Docker on my VPS running Ghost. Onwards and upwards (it's very apt that "sudo" in Italian means "I sweat" LOOOOL) <a href="https://aseachange.com/tags/mysocalledsudolife" class="mention hashtag" rel="nofollow noopener" target="_blank">#MySoCalledSudoLife</a> <a href="https://aseachange.com/tags/selfhosting" class="mention hashtag" rel="nofollow noopener" target="_blank">#selfhosting</a> <a href="https://aseachange.com/tags/newbie" class="mention hashtag" rel="nofollow noopener" target="_blank">#newbie</a>

daltux<a href="https://mastodon.chuggybumba.com/users/thanius" class="u-url mention" rel="nofollow noopener" target="_blank">@thanius@mastodon.chuggybumba.com</a> <a href="https://social.anoxinon.de/users/Codeberg" class="u-url mention" rel="nofollow noopener" target="_blank">@Codeberg@social.anoxinon.de</a> What if we set up a <a href="https://snac.daltux.net?t=fail2ban" class="mention hashtag" rel="nofollow noopener" target="_blank">#fail2ban</a> jail on HTTPd logs (how would we do this?) to block them, rather than consuming more costly CPU and network resources to generate and send the trap file? Would this be a viable solution? 🧠💭 <a href="https://snac.daltux.net?t=brainstorming" class="mention hashtag" rel="nofollow noopener" target="_blank">#brainstorming</a> <a href="https://snac.daltux.net?t=idea" class="mention hashtag" rel="nofollow noopener" target="_blank">#idea</a> <a href="https://snac.daltux.net?t=robots" class="mention hashtag" rel="nofollow noopener" target="_blank">#robots</a>

splaDes de les 7 de la tarda d'ahir, <a href="https://mastodont.cat/tags/fail2ban" class="mention hashtag" rel="nofollow noopener" target="_blank">#fail2ban</a> està bloquejant automàticament totes les IPs de bots xafarders, no només Amazonbot. Ara mateix ja ha bloquejat un total de 1.171 IP, bloqueig actiu de 327. Edito: cap robot obté res de mastodont.cat, només "veuen" que s'ha interromput la connexió gràcies a una configuració específica de nginx (el programari que serveix continguts).<a href="https://mastodont.cat/tags/scraping" class="mention hashtag" rel="nofollow noopener" target="_blank">#scraping</a> <a href="https://mastodont.cat/tags/BotsXafarders" class="mention hashtag" rel="nofollow noopener" target="_blank">#BotsXafarders</a>

ShawnT 🐀```bash root@machine:/etc/fail2ban/jail.d# fail2ban-client status sshd Status for the jail: sshd |- Filter | |- Currently failed: 2 | |- Total failed: 141649 | `- File list: /var/log/auth.log `- Actions |- Currently banned: 16 |- Total banned: 35247 `- Banned IP list: YOU KNOW WHO YOU ARE ``` It's the little things the make life safer against the background radiation of the Internet. Always use <a href="https://mastodon.coffee/tags/fail2ban" class="mention hashtag" rel="nofollow noopener" target="_blank">#fail2ban</a>, even if it's cranky.

ppom<a href="https://mamot.fr/tags/reaction" class="mention hashtag" rel="nofollow noopener" target="_blank">#reaction</a> v2.2.0 is released!Two big new features: - Full IP support (built-in regex, ip ranges, different actions on IPv4 and IPv6...) - Options for action deduplicationSee the release for a more detailed changelog: <a href="https://framagit.org/ppom/reaction/-/releases/v2.2.0" rel="nofollow noopener" translate="no" target="_blank">https://framagit.org/ppom/reaction/-/releases/v2.2.0</a><a href="https://mamot.fr/tags/reaction" class="mention hashtag" rel="nofollow noopener" target="_blank">#reaction</a>-rust <a href="https://mamot.fr/tags/rust" class="mention hashtag" rel="nofollow noopener" target="_blank">#rust</a> <a href="https://mamot.fr/tags/fail2ban" class="mention hashtag" rel="nofollow noopener" target="_blank">#fail2ban</a>

House Panther :verified_paw:I really hate the assholery out there on the <a href="https://goblackcat.social/tags/interwebs" class="mention hashtag" rel="nofollow noopener" target="_blank">#interwebs</a>. If it weren’t for <a href="https://goblackcat.social/tags/fail2ban" class="mention hashtag" rel="nofollow noopener" target="_blank">#fail2ban</a>, I’d be facing even more aggressive daily denials of service attacks. I get these periods of times where shit slows down to a crawl and I get these random attacks. I’m almost certain that they’re happening on the SSH and WireGuard ports. Yes, changing the SSH port to a non-standard port does help some and I think I am going to do that when I get home to mitigate this somewhat. But it will be only a matter of time before a port scanner discovers the new SSH port and alerts the bots to the new port. I’m sure that the bots are also trying to attack WireGuard. WireGuard is damn near impossible so the bots are simply just trying to be assholes for the sake of breaking <a href="https://goblackcat.social/tags/Mastodon" class="mention hashtag" rel="nofollow noopener" target="_blank">#Mastodon</a>.It wouldn’t surprise me if the Twitter, X, or whatever flavor of the month fuckers were behind it. WireGuard keeps no logs so I have no idea. I’d have to do a <a href="https://goblackcat.social/tags/wireshark" class="mention hashtag" rel="nofollow noopener" target="_blank">#wireshark</a> and see what IP addresses are trying to break WireGuard. Bottom line is I think I need some more advanced routing capabilities. I may look into adding <a href="https://goblackcat.social/tags/ZenArmor" class="mention hashtag" rel="nofollow noopener" target="_blank">#ZenArmor</a> to my defensive tools. ZenArmor offers deep packet inspection. This would allow a little bit smarter blocking of the bots based on their traffic signatures. This way I whatever gets through the geoblocking, could potentially get nailed by ZenArmor. Then what gets missed by ZenArmor will get cleaned up by fail2ban. I’ll have to see how difficult ZenArmor is to configure. If it’s going to be a bitch, I’ll replace <a href="https://goblackcat.social/tags/AlmaLinux" class="mention hashtag" rel="nofollow noopener" target="_blank">#AlmaLinux</a> on my VPS with <a href="https://goblackcat.social/tags/OPNsense" class="mention hashtag" rel="nofollow noopener" target="_blank">#OPNsense</a>, a true router/firewall.

House Panther :verified_paw:I am having a lot of fun with <a href="https://goblackcat.social/tags/fail2ban" class="mention hashtag" rel="nofollow noopener" target="_blank">#fail2ban</a>. Since all of my <a href="https://goblackcat.social/tags/ssh" class="mention hashtag" rel="nofollow noopener" target="_blank">#ssh</a> authentication is done through ssh keys, I've set the failure threshold to 0. So that means as soon as the failure occurs, the IP address is blocked. I've noticed that the combination of geoblocking and setting the failure threshold to 0, the assholery is lessening. I guess the bots aren't even bothering.

𝕂𝚞𝚋𝚒𝚔ℙ𝚒𝚡𝚎𝚕<a href="https://other.li/@monkee" class="u-url mention" rel="nofollow noopener" target="_blank">@monkee</a> mMn sind viele (vor allem die alten) auch sehr plump und schutz geht auch anders und <a href="https://chaos.social/tags/fail2ban" class="mention hashtag" rel="nofollow noopener" target="_blank">#fail2ban</a> ist ja schon mal ein anfang – DIE lösung habe / kenne ich noch nicht ausser die oben erwähnten.

LovesTha🥧<a href="https://floss.social/tags/SelfHosting" class="mention hashtag" rel="nofollow noopener" target="_blank">#SelfHosting</a> question: when hosting a bunch of services on the same box (say all in docker containers), do you do <a href="https://floss.social/tags/fail2ban" class="mention hashtag" rel="nofollow noopener" target="_blank">#fail2ban</a> in each containerised service or globally on the host? <a href="https://floss.social/tags/AskFedi" class="mention hashtag" rel="nofollow noopener" target="_blank">#AskFedi</a>

nan0Is there an "easy" way to sync IPs that get banned via <a href="https://chaos.social/tags/fail2ban" class="mention hashtag" rel="nofollow noopener" target="_blank">#fail2ban</a> between servers?:BoostOK:

Sean RileyOK so I finally go fail2ban to play nice with pf while keeping the apple Application firewall happy. I'm going to step away now...Will need to document later.<a href="https://opensocial.media/tags/BSD" class="mention hashtag" rel="nofollow noopener" target="_blank">#BSD</a> <a href="https://opensocial.media/tags/Apple" class="mention hashtag" rel="nofollow noopener" target="_blank">#Apple</a> <a href="https://opensocial.media/tags/fail2ban" class="mention hashtag" rel="nofollow noopener" target="_blank">#fail2ban</a> <a href="https://opensocial.media/tags/pf" class="mention hashtag" rel="nofollow noopener" target="_blank">#pf</a>

Geeky Malcölm 🇨🇦<a href="https://infosec.exchange/@nono2357" class="u-url mention" rel="nofollow noopener" target="_blank">@nono2357</a> I'm running an <a href="https://ioc.exchange/tags/obfs4" class="mention hashtag" rel="nofollow noopener" target="_blank">#obfs4</a> proxy on a VPS & followed this. It's amazing how many attempted logins get blocked with <a href="https://ioc.exchange/tags/fail2ban" class="mention hashtag" rel="nofollow noopener" target="_blank">#fail2ban</a>. SSH Key Authentication is also amazing.

JordanThe Wordpress login brute-force bots are in full swing lately..<a href="https://defcon.social/tags/wordpress" class="mention hashtag" rel="nofollow noopener" target="_blank">#wordpress</a> <a href="https://defcon.social/tags/scriptkiddie" class="mention hashtag" rel="nofollow noopener" target="_blank">#scriptkiddie</a> <a href="https://defcon.social/tags/bruteforce" class="mention hashtag" rel="nofollow noopener" target="_blank">#bruteforce</a> <a href="https://defcon.social/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://defcon.social/tags/sysadmin" class="mention hashtag" rel="nofollow noopener" target="_blank">#sysadmin</a> <a href="https://defcon.social/tags/fail2ban" class="mention hashtag" rel="nofollow noopener" target="_blank">#fail2ban</a>

ppom<a href="https://mamot.fr/tags/reaction" class="mention hashtag" rel="nofollow noopener" target="_blank">#reaction</a> 's v2.1.0 is published! News: - big performance improvements on regex matching 🚀 - new 'trigger' command to manually ban IPs 👋 (or whatever you're doing with reaction!) - 'oneshot' actions option, useful for alerting 🚨<a href="https://framagit.org/ppom/reaction/-/releases/v2.1.0" rel="nofollow noopener" translate="no" target="_blank">https://framagit.org/ppom/reaction/-/releases/v2.1.0</a>reaction is a software which aims to replace <a href="https://mamot.fr/tags/fail2ban" class="mention hashtag" rel="nofollow noopener" target="_blank">#fail2ban</a> on UNIX servers, while being faster, more flexible, an nicer to configure. <a href="https://mamot.fr/tags/rust" class="mention hashtag" rel="nofollow noopener" target="_blank">#rust</a> <a href="https://mamot.fr/tags/monitoring" class="mention hashtag" rel="nofollow noopener" target="_blank">#monitoring</a> <a href="https://mamot.fr/tags/alerting" class="mention hashtag" rel="nofollow noopener" target="_blank">#alerting</a> <a href="https://mamot.fr/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a>

Dave RobinsonTo recap on a post from about 2 weeks ago ( <a href="https://europhiles.uk/@dave/statuses/01JWPDZ6960F1GW4VBRK8EXAE0" rel="nofollow noopener" target="_blank">https://europhiles.uk/@dave/statuses/01JWPDZ6960F1GW4VBRK8EXAE0</a>), due to an error on my part I have been pestered for over a year by Matrix chat servers trying to contact my own long-dead chat server, despite my proxy returning 404 errors. I have now spent a week returning 410 errors (meaning I have gone, am never coming back, and please delete me from your records). This appears to have had no effect, despite the Matrix server to server API spec saying that servers should respect failures and use exponential back-off. Anyway, I have now started returning 410s and banning the IP address for 24 hours (doubling each time they further transgress). After less than a day, 250 IP addresses have been blocked. I'm quite loathe to do this, because it will have the effect of blocking any Fediverse servers that happen to use the same IP address. Hopefully that won't end up being a problem. Anyway, it just shows how much pointless noise and crap is whizzing around the Internet (using up bandwidth, energy and money) just because people either can't be bothered, or lack the skills, to write things properly and make them behave sensibly. <a href="https://europhiles.uk/tags/matrix" class="mention hashtag" rel="nofollow noopener" target="_blank">#Matrix</a> <a href="https://europhiles.uk/tags/fail2ban" class="mention hashtag" rel="nofollow noopener" target="_blank">#Fail2Ban</a>

aaron ~# :blinkingcursor:This is just beautiful. The project uses <a href="https://infosec.exchange/tags/MariaDB" class="mention hashtag" rel="nofollow noopener" target="_blank">#MariaDB</a> to store all the collected data. It makes heavy use of <a href="https://infosec.exchange/tags/API" class="mention hashtag" rel="nofollow noopener" target="_blank">#API</a> endpoints which will be a top priority not only for the internal workings. My focus mostly lies in making this as flexible as possible so people can configure it exactly as they need it. Configuration will be in <a href="https://infosec.exchange/tags/yaml" class="mention hashtag" rel="nofollow noopener" target="_blank">#yaml</a>.What i got so far is:<ul><li>packet capturing (from client, sent to the control server)</li><li>a webhook (which will be a drop-in replacement for <a href="https://infosec.exchange/tags/Discord" class="mention hashtag" rel="nofollow noopener" target="_blank">#Discord</a>'s since a lot of services support sending logs to discord webhooks)</li></ul>What's planned:<ul><li>Log file monitoring (like <a href="https://infosec.exchange/tags/Fail2Ban" class="mention hashtag" rel="nofollow noopener" target="_blank">#Fail2Ban</a>, but more advanced and easier to configure)</li><li>A fully featured dashboard which visualizes the data and gives you control and a transparent overview of your network activity.</li><li>IP banning (multiple ways to make it flexible)</li><li>Maybe even some advanced responses (like reporting all ports as open for nmap scans)</li></ul>I would be very interested to know what you think. Ideas, criticism and questions are very welcome. As soon as the base is working, i will push it to <a href="https://infosec.exchange/tags/Github" class="mention hashtag" rel="nofollow noopener" target="_blank">#Github</a>.<a href="https://infosec.exchange/tags/developement" class="mention hashtag" rel="nofollow noopener" target="_blank">#developement</a> <a href="https://infosec.exchange/tags/coding" class="mention hashtag" rel="nofollow noopener" target="_blank">#coding</a> <a href="https://infosec.exchange/tags/sideproject" class="mention hashtag" rel="nofollow noopener" target="_blank">#sideproject</a> <a href="https://infosec.exchange/tags/homelab" class="mention hashtag" rel="nofollow noopener" target="_blank">#homelab</a> <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> <a href="https://infosec.exchange/tags/networking" class="mention hashtag" rel="nofollow noopener" target="_blank">#networking</a> <a href="https://infosec.exchange/tags/monitoring" class="mention hashtag" rel="nofollow noopener" target="_blank">#monitoring</a> <a href="https://infosec.exchange/tags/xdr" class="mention hashtag" rel="nofollow noopener" target="_blank">#xdr</a>

Charles PerryAnyone out there have experience writing custom filters for fail2ban? I trying to write my first one for Apache on AlmaLinux 8 and running into problems. I’m not sure if the problem is the regex or the fact that I’m trying to scan multiple log files using wildcards in the logpath. I would be happy to pay for a few hours of consulting time. <a href="https://mstdn.social/tags/SysAdmin" class="mention hashtag" rel="nofollow noopener" target="_blank">#SysAdmin</a> <a href="https://mstdn.social/tags/fail2ban" class="mention hashtag" rel="nofollow noopener" target="_blank">#fail2ban</a>

Recent searches

Search options

Administered by:

Server stats:

#fail2ban

Recent searches

Search options

Administered by:

Server stats:

Fail2ban

#fail2ban