Fail2web
Infrastructure
server security administration
SHOW HN2014
How HN took it
2 positive, 0 neutral or asking, 1 mixed, 2 critical, out of 5 comments about the project. Thread score -0.07.
Idea: 2 for, 1 againstExecution: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
fail2ban is underappreciated and useful for small servers
From 2 comments
fail2ban is one the most under appreciated tools on small to medium Unix servers. I was first introduced to it when administering some web facing Asterisk servers (FreePBX) and…
Sean-Der on HNNice! I will have to give it a go sometime. unbanning from fail2ban is always a pain.
bhhaskin on HN
A web UI would help less experienced sysadmins
From 1 comment
Yes, the reality is that "baseball" is a bad password, and ssh as root is a bad idea but getting auth.log spammed into oblivion is also a bummer. It feels like a web GUI would…
fred_durst on HN
Objections
Fail2ban adds little security for SSH; key-based or other auth is better
From 1 comment
Exactly what fail2ban needed: a web UI for people to exploit. If I could eliminate any Linux service, it would probably be fail2ban. As an SSH security measure, it's more than…
akerl_ on HN
Extra components add complexity and risk of locking yourself out
From 1 comment
Thanks for making it. I'd like to give it a try some time. I certainly share your feeling about the awesomeness of fail2ban, as well as the slight awkwardness of interacting with…
gingerlime on HN
A web UI could be an attack surface
From 1 comment
Exactly what fail2ban needed: a web UI for people to exploit. If I could eliminate any Linux service, it would probably be fail2ban. As an SSH security measure, it's more than…
akerl_ on HN
Fail2ban log parsing can be overloaded by attackers
From 1 comment
It uses iptables, but it detects things to block by reading log files, and it's not exactly efficient in doing so. As such, if an attacker can pump lines in (like by having their…
akerl_ on HN
Requests
Support Internet Explorer (window.location.origin missing)
From 1 comment
So this looks like it will be pretty neat. I have it compiled and running. It seems to be mostly working. I did run into some issues. Like for instance, in the bundle.js file…
djengineerllc on HN
Fix ban updates returning empty IP list from fail2rest
From 1 comment
So this looks like it will be pretty neat. I have it compiled and running. It seems to be mostly working. I did run into some issues. Like for instance, in the bundle.js file…
djengineerllc on HN
Questions
How fail2ban locks users out or gets overloaded given it uses iptables
From 1 comment
I thought Fail2Ban hooked directly into iptables? How would you get locked out or overloaded? I don't necessarily think Fail2Ban needed a GUI, but I guess I never thought it was…
ChikkaChiChi on HN
Alternatives named
fwknop single packet authorization
From 1 comment
Exactly what fail2ban needed: a web UI for people to exploit. If I could eliminate any Linux service, it would probably be fail2ban. As an SSH security measure, it's more than…
akerl_ on HN
google_authenticator PAM TOTP
From 2 comments
Exactly what fail2ban needed: a web UI for people to exploit. If I could eliminate any Linux service, it would probably be fail2ban. As an SSH security measure, it's more than…
akerl_ on HNAdd http://www.heiho.net/pam_shield/ and http://www.snafu.priv.at/mystuff/pam_recent.c to that list. I use use some iptables voodoo with them to auto-whitelist on successful auth…
ryan-c on HN
knockknock single packet auth
From 1 comment
Exactly what fail2ban needed: a web UI for people to exploit. If I could eliminate any Linux service, it would probably be fail2ban. As an SSH security measure, it's more than…
akerl_ on HN
pam_shield and pam_recent with iptables
From 1 comment
Add http://www.heiho.net/pam_shield/ and http://www.snafu.priv.at/mystuff/pam_recent.c to that list. I use use some iptables voodoo with them to auto-whitelist on successful auth…
ryan-c on HN