Denyhosts vs fail2ban vs iptables- best way to prevent brute force logons?

Posted by spiffytech on Server Fault See other posts from Server Fault or by spiffytech
Published on 2010-04-03T01:07:49Z Indexed on 2010/04/03 1:13 UTC
Read the original article Hit count: 533

Filed under:

denyhosts

|

fail2ban

|

iptables

|

brute-force-attacks

I'm setting up a LAMP server and need to prevent SSH/FTP/etc. brute-force logon attempts from succeeding. I've seen many recommendations for both denyhosts and fail2ban, but few comparisons of the two. I also read that an IPTables rule can fill the same function.

Why would I choose one of these methods over another? How do people on serverfault handle this problem?

© Server Fault or respective owner

Related posts about denyhosts

fail2ban and denyhosts constantly ban me on Ubuntu

as seen on Server Fault - Search for 'Server Fault'
I just got an Ubuntu instance on Linode. To secure the SSH on it, I installed fail2ban (using apt-get), but then had a problem: fail2ban kept banning my IP (for limited durations, thankfully) even though I was entering the correct password. So I removed fail2ban and installed denyhosts instead. Same… >>> More
Secure Your Server with Denyhosts

as seen on Internet.com - Search for 'Internet.com'
<b>Geekride:</b> "DenyHosts is a tool i use to secure my SSH server from these type of people. Written in python, this tool serves as a very active security guard and helps me to keep my system safe from lots of prying eyes." >>> More
Package denyhosts in Ubuntu Trusty Tahr is deleted: temporary or forever?

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
While doing a test-upgrade of our Ubuntu server to 14.04, I found that the package DenyHosts is no longer available. Installing it gives following error: apt-get install denyhosts Reading package lists... Done Building dependency tree Reading state information... Done E: Unable to locate package… >>> More
Denyhosts vs fail2ban vs iptables- best way to prevent brute force logons?

as seen on Server Fault - Search for 'Server Fault'
I'm setting up a LAMP server and need to prevent SSH/FTP/etc. brute-force logon attempts from succeeding. I've seen many recommendations for both denyhosts and fail2ban, but few comparisons of the two. I also read that an IPTables rule can fill the same function. Why would I choose one of these… >>> More
hosts.deny not working

as seen on Server Fault - Search for 'Server Fault'
Currently I am watching the live auth.log and someone is continuously trying the brute force attack for 10 hours. Its my local server so no need to worry but I want to test. I have installed denyhosts. There is already an entry for that IP address in hosts.deny. But still he is trying the attacks… >>> More

Related posts about fail2ban

fail2ban Error Gentoo

as seen on Server Fault - Search for 'Server Fault'
Hi All I've recently setup a new VPS running Gentoo (My first time using the distro so please forgive me is this is a really easy one) and as I've done with other servers installed fail2ban. Setting it up to block the host via iptables, on too many unsuccessful logins with ssh. However I'm getting… >>> More
Custom fail2ban Filter

as seen on Server Fault - Search for 'Server Fault'
In my quest to block excessive failed phpMyAdmin login attempts with fail2ban, I've created a script that logs said failed attempts to a file: /var/log/phpmyadmin_auth.log Custom log The format of the /var/log/phpmyadmin_auth.log file is: phpMyadmin login failed with username: root; ip: 192.168… >>> More
Custom fail2ban Filter for phpMyadmin bruteforce attempts

as seen on Server Fault - Search for 'Server Fault'
In my quest to block excessive failed phpMyAdmin login attempts with fail2ban, I've created a script that logs said failed attempts to a file: /var/log/phpmyadmin_auth.log Custom log The format of the /var/log/phpmyadmin_auth.log file is: phpMyadmin login failed with username: root; ip: 192.168… >>> More
What are fail2ban's log iptables "returned 400" entries?

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
In my fail2ban.log there are some entries the meaning of which I don't understand (and haven't found searching around)... For instance, a couple of examples from my log: iptables -I INPUT -p tcp -m multiport --dports ssh -j fail2ban-ssh-ddos returned 400 ... iptables -I INPUT -p tcp -m multiport… >>> More
fail2ban block ports rules iptable

as seen on Server Fault - Search for 'Server Fault'
I just installed Ubuntu Server 14.04 and don't have much experience with IPtables. I am trying to get a basic setup going where I only accept SSH connections on port 22 and 2222. I actually have that working with no problem using fail2ban ssh. Then I wanted to block all other ports except 423 and… >>> More