From: Cyril J. <cyr...@bl...> - 2006-01-17 23:36:01
|
Hi Nils, I've never tried DenyHosts so I can't really compare it to Fail2ban. However, I can comment a bit on Fail2ban. * I'm preparing a new release (0.6.1) which will add support for /etc/hosts.deny and shorewall. This will only require changes in the configuration file. Fail2ban is quite flexible. You can do almost everything you want by tweaking the configuration file. You will have different configuration files: fail2ban.conf.iptables fail2ban.conf.hostsdeny fail2ban.conf.shorewall Copy the desired configuration file to /etc/fail2ban.conf, install iptables or shorewall if required and that's all. * I know that DenyHosts has a better documentation than Fail2ban. That's a really important point I think. I'm not a native english speaker and it takes me a lot of time to do (poorly written) documentation. * DenyHosts works on FreeBSD. Fail2ban should work on this system too without too much problems. However, I never get feedback from *BSD or other Unix platform. * Fail2Ban can monitor several files. You can check for failures in /var/log/apache2/error_log and /var/log/sshd/current. You could also decide to ban users which try to access to "_vti_bin" on your Apache server. Fail2ban is not designed for login failure only. I will start a new development branch on March (I'm too busy now). The idea is to make Fail2ban a log parser that can execute actions on given events. It will provide much more "template" and will be "modular" (no unique huge configuration file anymore). I also want to take advantage of inotify or FAM instead of polling for file modification. Regards, Cyril Jaquier Nils Breunese (Lemonbit Internet) wrote: > Hello, > > I've used DenyHosts [1] in the past and I'm currently using Fail2Ban. > The obvious differences I found is that Fail2Ban blocks hosts using > firewall rules, whereas DenyHosts uses /etc/hosts.deny. I know that > DenyHosts can be extended to (also) use firewall rules, but I like > Fail2Ban because it works like that out of the box. Can anybody point > out to me what the other differences between these two scripts are and > why you would choose one over the other? > > Thanks, > > Nils Breunese. > > [1] http://denyhosts.sourceforge.net/ > > > ------------------------------------------------------- > This SF.net email is sponsored by: Splunk Inc. Do you grep through log > files > for problems? Stop! Download the new AJAX search engine that makes > searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! > http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642 > _______________________________________________ > Fail2ban-users mailing list > Fai...@li... > https://lists.sourceforge.net/lists/listinfo/fail2ban-users > |