On: Analyzing the attacks on my website

[ringzero]

You may have accidentally reinvented https://en.wikipedia.org/wiki/Fail2ban :)

[JeremyMorgan → ringzero]

That wasn't really the point of the article, I'm showing how to gather data on where they came from. Blocking is completely optional, and not for everyone.

[bdamm → ringzero]

fail2ban is saving my bacon right now.

[ryanlol → bdamm]

From what? Generally fail2ban only exposes unnecessary attack surface while providing zero benefit.

[omgwtfbyobbq → ryanlol]

How does fail2ban expose attack surface?

[detaro → omgwtfbyobbq]

It's code running on partially attacker-controlled inputs. It several times had vulnerabilities that allowed an attacker to trigger blocks for arbitrary IPs.

[cyc115 → omgwtfbyobbq]

I remember there's a privEsc on old versions of fail2ban.

[omgwtfbyobbq → cyc115]

Do you remember roughly when the privEsc was?

https://www.cvedetails.com/vulnerability-list/vendor_id-5567...

[ryanlol → omgwtfbyobbq]

Sketchy parsers operating on untrusted, unstructured log data.

fail2ban is worse than useless.