DDoS

In the previous post, we described how to install Fail2ban to protect your system. Now we are going to go a step further to activate the reporting of malicious activity to global blacklist managed by the tool AbuseIPDB. What is AbuseIPDB? AbuseIPDB is a project dedicated to helping systems administrators and webmasters check and report IP addresses which are involved in malicious activities such as spamming, hacking attempts, DDoS attacks, or any abusive activity on the Internet. ...

What is Fail2ban? Fail2ban is a software written in Python which help us to prevent brute force or DDoS attacks. It uses the failed access attempts logged in the system to detect the malicious IP addresses. Then, these IP addresses are blocked to avoid more attempts. It’s a software highly recommended to have installed in any system exposed to The Internet. How does Fail2ban work? Fail2ban is as a daemon which is monitoring every access to the system to the different services which have open ports (Mainly SSH, HTTPS…). It monitors the number of access attemps from a single IP address, and when Fail2ban detects the number of attemps which are suspicios to be an attack. Once identified a possible attacker Fail2ban uses the system Firewall (Iptables in Linux systesms) to block the IP address. From that moment that IP address will not be allowed to access the system. ...