SpamAssassin
Fail2Ban
Our great sponsors
SpamAssassin | Fail2Ban | |
---|---|---|
7 | 49 | |
274 | 10,198 | |
2.6% | 4.4% | |
8.5 | 8.8 | |
about 8 hours ago | 2 days ago | |
Perl | Python | |
Apache License 2.0 | GNU General Public License v3.0 or later |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
SpamAssassin
-
Ok, I've migrated email to selfhosted
spamassassin or rspamd or ASSP. All very good. Spamassassin just works, but you need to feed it a good cohort of spam and ham (about 1000 messages each). Most people only send it the spam which will then bias it quite a bit and not have it classify spam as spam unless it's the worst of the bunch. Spamassassin is a filter for your mail server. rspamd is the same idea. ASSP is highly configurable and a proxy.
-
Why Your Emails May Be Bouncing Back & What You Can Do About It
To detect whether incoming emails are malicious, mail servers also use spam scanners, such as Apache's popular SpamAssasin. The internal workings of these spam scanners can be somewhat complicated (involving Naive Bayes Classifiers on trained, large datasets, for the curious), but the primary takeaway is that these classification systems typically assign a numerical point value to an incoming email to determine the validity of the message. The higher the score, the more likely that the email is spam. For reference, the ISP Optimum states the following regarding their spam filtering:
Fail2Ban
-
Looking for a way to remote in to K's of raspberry pi's...
now some things you need to think about: - cloud init - this will need to be secure so lock it down hard anything not needed an alternative OS to look at if you have the ability's is https://www.alpinelinux.org/ also as these devices are not that powerfull every extra agent / abstaction layer you add impacts performance need to look at low over head security https://www.crowdsec.net/ and https://github.com/fail2ban/fail2ban (if you call fail2ban security) - using certificates to authenticate ssh login
- Fail2Ban – Daemon to ban hosts that cause multiple authentication errors
-
Home Lab Setup Recommendations
- Nginx & crowdsec/fail2ban if you are exposing your parts (services) to the public ( https://hub.docker.com/r/baudneo/nginx-proxy-manager, https://www.crowdsec.net, https://www.fail2ban.org )
-
Firewall rules beyond "deny incoming, enable only the ports that you need"
https://github.com/fail2ban/fail2ban is a mature, easy to set up way to have some dynamic firewall rules that respond to attacks. There are more sophisticated options, but they are probably not worth the return on time investment for you.
-
Fail2Ban Limitation
Others seem to be (or were) experiencing this too: https://github.com/fail2ban/fail2ban/issues/3100
-
Configuring Fail2ban for Traefik Reverse Proxy
I've played a bit with Traefik as reverse proxy and wanted to implement fail2ban for it, after switching from Nginx Proxy Manager. It finally works and successfully bans threat actors that conduct malicous HTTP requests. As soon as a multitude of HTTP errors are detected by fail2ban in Traefik's JSON access logs, the attacker's IP address is banned. I am using a dockerized fail2ban container and ban locally via iptables as well as optionally on Cloudflare, using Cloudflare's API. A ban notification via Telegram can also be configured.
- SSHGuard
-
About the roadmap...
However I do not merely rely on this trust. I monitor my systems aggressively. I implement additional security measures to mitigate my exposure and liability. There are systems like fail2ban and login-shield that I use as additional layers (and have audited the code - these systems are a lot simpler than Linux - it's unrealistic for anybody to actually fully-audit the Linux kernel).
- Fail2Ban Release 1.0.1 (2022/09/27)
-
How to access Docker containers on home server from public IP?
You need to setup reverse proxy. nginx-proxy-manager, swag. There are also more options like caddy, haproxy etc... You can also setup a VPN and or a service like authelia, fail2ban, crowdsec to restrict access to your site.
What are some alternatives?
crowdsec - CrowdSec - the open-source and participative security solution offering crowdsourced protection against malicious IPs and access to the most advanced real-world CTI.
Suricata - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.
Snort - Snort++
Denyhosts - Automated host blocking from SSH brute force attacks
OSSEC - OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
pfSense - Main repository for pfSense
Wazuh - Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
Nginx Proxy Manager - Docker container for managing Nginx proxy hosts with a simple, powerful interface
maltrail - Malicious traffic detection system
wazuh-ruleset - Wazuh - Ruleset
fwknop - Single Packet Authorization > Port Knocking