3

I recently installed fail2ban on a VPS ( Ubuntu 20.04 ), with a very simple configuration to disperse ssh brute-force attackers.

I am using fail2ban with ufw ( banaction = ufw ) and I decided to ban them permanently ( bantime = -1 ).

This works great and it's exactly the result I was after. One caveat though:

When looking at the lengthy list of banned IP's returned by fail2ban and ufw status queries after 10 days it makes me wonder:

Is this setup going to lead to storage problems eventually?

( This is a matter of experience, and I have next to none in this field ).

If storage might become an issue, would it perhaps be a better idea to work with finite bantime values?

I have deliberately chosen a very simply setup ( in line with the limited knowledge and time I have ). Here is the simple sshd jail I defined in 'jail.local':

[sshd]

enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 7 
banaction = ufw
findtime = 86400 
bantime = -1
darbehdar
  • 230

1 Answers1

3

Is this setup going to lead to storage problems eventually?

Even if I addresses are stored as text, one won't need more than 15 bytes to store (4 * 3 numbers + 3 dots).

That means 1 million addresses will take only 15 MB, so I don't think you need to worry on that unless you've a really famous site with huge number of attacks.

Máté Juhász
  • 22,071