Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've just bought a new dedicated server. Should I install fail2ban if I am only using SSH keys to login? What else does fail2ban protect? What are the advantages and disadvantages of fail2ban? Is there a better alternative?

I have also disabled root logins and installed sudo. It is an Arch Linux server supplied by OVH. I intend to install nginx and gitolite.

share|improve this question

closed as primarily opinion-based by Iszi, TildalWave, Xander, Adnan, NULLZ Aug 14 '13 at 23:42

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
Yes, no, I don't know. There's no way to answer this question. It's like asking "I've just left work, should I go eat a pizza if I'm only reading Sophie's Choice?". I don't know, are you hungry? Do you like pizza? Is your wife cooking something today? How many times have you eaten out this week? –  Adnan Aug 14 '13 at 20:48
    
@Adnan I'm not sure I entirely understand. wiki.archlinux.org/index.php/Fail2ban suggests it is unnecessary, but over the years I have read many great things about fail2ban and other similar software. I would like the opinion of the experts here, before I make my decision. –  Alex Chamberlain Aug 14 '13 at 20:54
1  
Sorry, your question is still unanswerable. It all depends on your case. What are you planning to do with your server? –  Adnan Aug 14 '13 at 20:58
    
@Adnan I'll be using it for a low traffic, static blog. There will also be several git repos mirrored. –  Alex Chamberlain Aug 14 '13 at 21:00
    
If anything it cuts down on your logs. –  k to the z Aug 14 '13 at 21:47

1 Answer 1

up vote 3 down vote accepted

Since it varies on a case-to-case basis, there is no perfect answer to your question.

Yet, from an information security point of view, installing fail2ban (or any alike solution) would definitely add an additional layer of security... and that's something you can regard to always be a good decision.

My 2 cents: just go ahead and do it. In the end, you're better safe than sorry.

share|improve this answer
    
I kind of agree, but if the OP has no problems with DoS or repeat malicious visitors, then there isn't much need. –  Rory Alsop Aug 14 '13 at 21:39

Not the answer you're looking for? Browse other questions tagged or ask your own question.