Re: [Fail2ban-users] DenyHosts vs Fail2Ban

[Cyril J. <cyr...@bl...>]

Hi Nils,

I've never tried DenyHosts so I can't really compare it to Fail2ban.
However, I can comment a bit on Fail2ban.

* I'm preparing a new release (0.6.1) which will add support for
/etc/hosts.deny and shorewall. This will only require changes in the
configuration file. Fail2ban is quite flexible. You can do almost
everything you want by tweaking the configuration file. You will have
different configuration files:

fail2ban.conf.iptables
fail2ban.conf.hostsdeny
fail2ban.conf.shorewall

Copy the desired configuration file to /etc/fail2ban.conf, install
iptables or shorewall if required and that's all.

* I know that DenyHosts has a better documentation than Fail2ban. That's
a really important point I think. I'm not a native english speaker and
it takes me a lot of time to do (poorly written) documentation.

* DenyHosts works on FreeBSD. Fail2ban should work on this system too
without too much problems. However, I never get feedback from *BSD or
other Unix platform.

* Fail2Ban can monitor several files. You can check for failures in
/var/log/apache2/error_log and /var/log/sshd/current. You could also
decide to ban users which try to access to "_vti_bin" on your Apache
server. Fail2ban is not designed for login failure only.

I will start a new development branch on March (I'm too busy now). The
idea is to make Fail2ban a log parser that can execute actions on given
events. It will provide much more "template" and will be "modular" (no
unique huge configuration file anymore). I also want to take advantage
of inotify or FAM instead of polling for file modification.

Regards,

Cyril Jaquier


Nils Breunese (Lemonbit Internet) wrote:
> Hello,
> 
> I've used DenyHosts [1] in the past and I'm currently using Fail2Ban. 
> The obvious differences I found is that Fail2Ban blocks hosts using 
> firewall rules, whereas DenyHosts uses /etc/hosts.deny. I know that 
> DenyHosts can be extended to (also) use firewall rules, but I like 
> Fail2Ban because it works like that out of the box. Can anybody point 
> out to me what the other differences between these two scripts are  and
> why you would choose one over the other?
> 
> Thanks,
> 
> Nils Breunese.
> 
> [1] http://denyhosts.sourceforge.net/
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through log
> files
> for problems?  Stop!  Download the new AJAX search engine that makes
> searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
> _______________________________________________
> Fail2ban-users mailing list
> Fai...@li...
> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>