3

I recently installed fail2ban on a VPS ( Ubuntu 20.04 ), with a very simple configuration to disperse ssh brute-force attackers.

I am using fail2ban with ufw ( banaction = ufw ) and I decided to ban them permanently ( bantime = -1 ).

This works great and it's exactly the result I was after. One caveat though:

When looking at the lengthy list of banned IP's returned by fail2ban and ufw status queries after 10 days it makes me wonder:

Is this setup going to lead to storage problems eventually?

( This is a matter of experience, and I have next to none in this field ).

If storage might become an issue, would it perhaps be a better idea to work with finite bantime values?

I have deliberately chosen a very simply setup ( in line with the limited knowledge and time I have ). Here is the simple sshd jail I defined in 'jail.local':

[sshd]

enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 7 
banaction = ufw
findtime = 86400 
bantime = -1 

1 Answer 1

3

Is this setup going to lead to storage problems eventually?

Even if I addresses are stored as text, one won't need more than 15 bytes to store (4 * 3 numbers + 3 dots).

That means 1 million addresses will take only 15 MB, so I don't think you need to worry on that unless you've a really famous site with huge number of attacks.

1
  • Thanks for the heuristics. It was just not clear to me how / where the banned IPs lists might be stored.
    – darbehdar
    Jul 17, 2020 at 6:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .