this post was submitted on 20 Feb 2024
11 points (92.3% liked)

homelab

6589 readers
1 users here now

founded 5 years ago
MODERATORS
CMonster@lemmy.ml
11
Setting up fail2ban on Debian 12 (lemmy.world)
submitted 1 year ago by root@lemmy.world to c/homelab@lemmy.ml
5 comments fedilink hide all child comments
 

I've used fail2ban in the past on Ubuntu, and it was very easy to setup.

Apparently on Debian, there is no /var/log/auth.log, and it does not use iptables, so fail2ban is not seeing the failed login attempts and jailing the purp.

Has anyone set this up successfully before? I see suggestions online to set backend = systemd, but this does not seem to be fixing the issue for me.

you are viewing a single comment's thread
view the rest of the comments
[โ€“] aniki@lemm.ee 3 points 1 year ago (1 children)

If you're looking for an SSH jail I think the Arch docs are going to be relevant, as it looks like it's configured much differently with systemd.

https://wiki.archlinux.org/title/Fail2ban

[โ€“] root@lemmy.world 2 points 1 year ago

Oooh, good point. I'm not even sure if I should be using this with cert only based auth

It does usually not make sense to use fail2ban with e.g sshd when only public key authentication or similar is enabled.