Elektrine
Log in Register

#fail2ban

5 posts · Last used 5d

Back to Timeline
mkleger
Michael @mkleger@swissodon.ch · Aug 07, 2026
Über 600'000 gebannte IPs auf einem Forgejo-System. Was zunächst nur als dauerhaft hohe CPU-Last in Checkmk auffiel, entpuppte sich als massiver Crawler-Traffic. Mit Log-Analyse und gezielten Fail2Ban-Jails konnten wir die Zugriffe automatisiert blockieren. Die CPU-Last fiel danach drastisch. Den technischen Ablauf habe ich im Blog festgehalten: https://www.onesystems.ch/blog/wie-monitoring-und-fail2ban-ueber-600000-ips-blockiert-haben/ #Checkmk #Fail2Ban #Linux #Monitoring
4
1
12
teledyn
teledyn 𓂀 @teledyn@mstdn.ca · Jul 28, 2026
Not sure why, but with the LAN I've needed to whitelist all hosts using #Jellyfin clients, otherwise their IP gets blocked by Fail2Ban after about an hour of watching. I fear this would happen to remote viewers too, but not sure I've ever watched more than an hour remotely. No idea if any other remote client services do the same, I've not let them run more than a few minutes. Is this perhaps a #debian #ufw #Fail2Ban setting I should know about?
0
1
0
nicd
Nicd @nicd@masto.ahlcode.fi · Jul 01, 2026
So I tried using #fail2ban to ban AI scrapers that are hammering my #Forgejo instance. I currently have 130k IPs in nftables and there's no end in sight. These are from all over, not from any specific ranges. It took fail2ban several hours to re-add the bans after restarting it for a configuration change. It's 21:45 now and it's currently processing hits from 09:11. I don't know if it will even catch the backlog. I suppose it's the wrong tool for this but I wanted to try. #SelfHosting
0
1
0
dazo
🐈‍⬛David Sommerseth @dazo@infosec.exchange · May 25, 2026
I always remap my sshd daemon to listen to a non-standard port, to reduce a lot of noise. Which has worked fine for years. But every now and then there are attempts. All the #Linux kernel flaws found lately has made remote login attempts more interesting for attackers. And they scan much more broadly now than just port 22. And that's why my second line of defence is to disallow remote root login - and also make use of the AllowGroups feature in sshd_config. Users granted remote access must be member of a specific group. And root is also excluded from this group. That pays off these days. And this is a nice filter match for #fail2ban and similar tools https://termbin.com/0cf6 I have 293 login attempts on "random users" since May 21. And 259 attempts as root. #infosec #ssh #sshd #systemhardening #kernel
6
2
2

You've seen all posts