K40-Whisperer-macOS
Fail2Ban
Our great sponsors
| K40-Whisperer-macOS | Fail2Ban | |
|---|---|---|
| 3 | 45 | |
| 13 | 8,603 | |
| - | 2.0% | |
| 0.0 | 0.0 | |
| about 1 month ago | 11 days ago | |
| Python | Python | |
| GNU General Public License v3.0 only | GNU General Public License v3.0 or later |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
K40-Whisperer-macOS
Fail2Ban
-
Home Lab Setup Recommendations
- Nginx & crowdsec/fail2ban if you are exposing your parts (services) to the public ( https://hub.docker.com/r/baudneo/nginx-proxy-manager, https://www.crowdsec.net, https://www.fail2ban.org )
-
Firewall rules beyond "deny incoming, enable only the ports that you need"
https://github.com/fail2ban/fail2ban is a mature, easy to set up way to have some dynamic firewall rules that respond to attacks. There are more sophisticated options, but they are probably not worth the return on time investment for you.
-
Fail2Ban Limitation
Others seem to be (or were) experiencing this too: https://github.com/fail2ban/fail2ban/issues/3100
-
Configuring Fail2ban for Traefik Reverse Proxy
I've played a bit with Traefik as reverse proxy and wanted to implement fail2ban for it, after switching from Nginx Proxy Manager. It finally works and successfully bans threat actors that conduct malicous HTTP requests. As soon as a multitude of HTTP errors are detected by fail2ban in Traefik's JSON access logs, the attacker's IP address is banned. I am using a dockerized fail2ban container and ban locally via iptables as well as optionally on Cloudflare, using Cloudflare's API. A ban notification via Telegram can also be configured.
- SSHGuard
-
About the roadmap...
However I do not merely rely on this trust. I monitor my systems aggressively. I implement additional security measures to mitigate my exposure and liability. There are systems like fail2ban and login-shield that I use as additional layers (and have audited the code - these systems are a lot simpler than Linux - it's unrealistic for anybody to actually fully-audit the Linux kernel).
- Fail2Ban Release 1.0.1 (2022/09/27)
-
How to access Docker containers on home server from public IP?
You need to setup reverse proxy. nginx-proxy-manager, swag. There are also more options like caddy, haproxy etc... You can also setup a VPN and or a service like authelia, fail2ban, crowdsec to restrict access to your site.
-
Newbie help...docker, portainer, godaddy
You need to look into reverse proxy. Most common one is nginx-proxy-manager which has a nice GUI. There is also SWAG. Both can been configured to get free SSL certificates. For security: authelia, fail2ban, crowdsec. I also suggest to configure wireguard, wg-easy. If you have any questions, we are here. Welcome and good luck!
-
PSA: Guys, don't expose RDP, there is even public automated tools for bruteforce (at least change port + enable Lock out, ideally Guacamole)
This is the fail2ban I'm talking about. https://github.com/fail2ban/fail2ban/wiki It basically add IPs to a list of blocked IPs if the SSH login fails too many times. I later switched to public/private key for ssh auth but I never turned off fail2ban while I had the server running.
What are some alternatives?
crowdsec - CrowdSec - the open-source and participative security solution offering crowdsourced protection against malicious IPs and access to the most advanced real-world CTI.
Suricata - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.
Snort - Snort++
Denyhosts - Automated host blocking from SSH brute force attacks
OSSEC - OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
pfSense - Main repository for pfSense
Nginx Proxy Manager - Docker container for managing Nginx proxy hosts with a simple, powerful interface
Wazuh - Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
meerk40t - Hackable Laser software for the K40 Stock-LIHUIYU laser boards.
SpamAssassin - Read-only mirror of Apache SpamAssassin. Submit patches to https://bz.apache.org/SpamAssassin/. Do not send pull requests
maltrail - Malicious traffic detection system
fwknop - Single Packet Authorization > Port Knocking