Hacker News Reader

fail2ban only blocks brute-force attacks from similar IPs right?

What if a botnet is used to do the brute-force, does fail2ban lock everybody out, effectively making fail2ban a tool that can be used for Denial of Service?

All I'd have to do now is to hammer your system with SSH attempts from my botnet and you can't log in anymore...

View on HN

If my IP is on your botnet than I've got bigger issues than not getting into my server. Namely you stealing my password and you getting into my server.

I think he means that fail2ban can't be effective against botnets attacks because if it didn't take IPs into account then it becomes a DDOS tool.

Therefore it must take IPs into account. Therefore it's not protection against brute-force password guessing from a botnet.

Reply on news.ycombinator.com