From: Nils B. (L. Internet) <ni...@le...> - 2006-01-17 23:50:30
|
Cyril Jaquier wrote: > I've never tried DenyHosts so I can't really compare it to Fail2ban. > However, I can comment a bit on Fail2ban. > > [snip] > > I will start a new development branch on March (I'm too busy now). The > idea is to make Fail2ban a log parser that can execute actions on > given > events. It will provide much more "template" and will be "modular" (no > unique huge configuration file anymore). I also want to take advantage > of inotify or FAM instead of polling for file modification. Phil Schwartz (the author of DenyHosts) is also extending functionality through the use of 'plugins' (which are really just scripts that take an IP address, so you can add them to whatever you like (iptables rules for instance)). Some words from Phil (I asked the same question on the DenyHosts mailinglist): "I don't know much about fail2ban, other than that it's firewall based rather that tcp_wrappers based. However, you could create a plugin for DenyHosts that updates your firewall settings in addition to tcp_wrappers. My server is behind a hardware based firewall so using a software solution (such as ipchains) seems redundant." It sounds a bit like Fail2Ban and DenyHosts are doing basically the same thing starting from a different point but growing more and more alike (and you both say you never tried the other script :)). Maybe you should contact Phil sometime to ask what he's up to. Bye, Nils. |