fail2ban-users

[Fail2ban-users] 99.93% attacks blocked

[Mike <t3...@ro...>]

There's a companion system to Fail2Ban that I'm using.  I thought I 
might share my most recent stats on this with the community.  This 
uses ipset and iptables like f2b does, but serves as a first line of 
defence before fail2ban..  After using this for 6+ months, I'm very 
impressed with the stats:
   _                 _             _____ _     _      _     _
  | |               (_)           / ____| |   (_)    | |   | |
  | |     ___   __ _ _ _ __ _____| (___ | |__  _  ___| | __| |
  | |    / _ \ / _` | | ^_ \______\___ \|  _ \| |/ _ \ |/ _` |
  | |___| (_) | (_| | | | | |     ____) | | | | |  __/ | (_| |
  |______\___/ \__, |_|_| |_|    |_____/|_| |_|_|\___|_|\__,_|
                __/ |
               |___/
============= Login-Shield Statistics based on current log files ===========
  Using: /var/log/messages and /var/log/secure
-- Number of login failures in log files: 8
Start: Jan  1 16:14:57
End  : Jan 14 03:16:22
=====================================
--        Number of filtered connections: 10993
============================================================================
Total system attacks: 11001
Blocked attempts    : 10993
Attacks got through : 8
---------------------------------
% Of Attacks Blocked: 99.9273%
============================================================================


This system is available at:

https://github.com/dpsystems/login-shield

Re: [Fail2ban-users] 99.93% attacks blocked

[Nick H. <ni...@ho...>]

On 15/01/2021 06:28, Mike wrote:
>
> There's a companion system to Fail2Ban that I'm using.  I thought I 
> might share my most recent stats on this with the community. This uses 
> ipset and iptables like f2b does, but serves as a first line of 
> defence before fail2ban..  After using this for 6+ months, I'm very 
> impressed with the stats:
>   _                 _             _____ _     _      _     _
>  | |               (_)           / ____| |   (_)    | |   | |
>  | |     ___   __ _ _ _ __ _____| (___ | |__  _  ___| | __| |
>  | |    / _ \ / _` | | ^_ \______\___ \|  _ \| |/ _ \ |/ _` |
>  | |___| (_) | (_| | | | | |     ____) | | | | |  __/ | (_| |
>  |______\___/ \__, |_|_| |_|    |_____/|_| |_|_|\___|_|\__,_|
>                __/ |
>               |___/
> ============= Login-Shield Statistics based on current log files 
> ===========
>  Using: /var/log/messages and /var/log/secure
> -- Number of login failures in log files: 8
> Start: Jan  1 16:14:57
> End  : Jan 14 03:16:22
> =====================================
> --        Number of filtered connections: 10993
> ============================================================================ 
>
> Total system attacks: 11001
> Blocked attempts    : 10993
> Attacks got through : 8
> ---------------------------------
> % Of Attacks Blocked: 99.9273%
> ============================================================================ 
>
>
>
> This system is available at:
>
> https://github.com/dpsystems/login-shield
>
Thanks but unfortunately totally US-centric.

Re: [Fail2ban-users] 99.93% attacks blocked

[Klaus L. <leh...@t-...>]

 
Guten Tag [Frau/Herr] Nick Howitt,
danke für Ihre Nachricht.
Am Freitag, 15. Januar 2021 um 09:53 schrieben Sie.
Ihre Nachricht finden Sie am Ende dieser eMail.

>> This system is available at:
>> https://github.com/dpsystems/login-shield


> Thanks but unfortunately totally US-centric.
sorry, but (imho) not totally!
see also: file: ipset-others.lst and ipset-proxies.lst (search for "BLANKde")

ups, germay has found in ipset-others.lst:
# de unitymedia b2b customer static pool
130.180.64.0/18
hm. only 1x ...

is it really a good idea, to have potentially "old" ip-lists ?

-> therefor is f2b a VERY good project.

yours, klaus

Re: [Fail2ban-users] 99.93% attacks blocked

[Mike <t3...@ro...>]

>Thanks but unfortunately totally US-centric.

I'm not sure where you get that?  The US related blocklist is 
separated from others.

If you're in a "hot zone" like China, Russia, etc, it probably won't 
work as well.  But the idea behind it is to limit access to login 
ports, and ideally you should have those areas whitelisted anyway.