I know what fail2ban does; it monitors the firewall logs and finds ip addresses that have too many failed logins to ssh; and then tells the firewall to drop packets from those addresses.

So is fail2ban an IPS?

  • 2
    For clarity, fail2ban doesn't read firewall logs, it reads the log file for whatever program you are monitoring (e.g. SSH, nginx, asterisk, etc) – multithr3at3d Jan 29 '20 at 22:24

Before categorising anything, it's important to understand the taxonomy first. That way you don't get bogged down in words that could have different meanings.

An IPS or an IDS is defined as a network-level detection control. A Host-Based IPS (HIPS) will also look at internal data but primarily looks at the network.

Given this differentiation, no, fail2ban is not a HIDS because it does not inspect the network (it looks at logs).

If you try to expand the taxonomy beyond its intent, then any host-based control could be considered a HIDS, like anti-virus or an OS-level account lockout on too many failed login attempts.

  • "An IPS or an IDS is defined as a network-level detection control". Do you have a reference for this I could use? I can't put "this guy on SE" in my thesis references :D. I couldn't find anything. Is OSSEC therefore also not an IDS? pdfs.semanticscholar.org/3eed/… – Nephilim Jul 6 '20 at 13:33
  • @Nephilim it's the basic taxonomy. HIDS/HIPS is host-based. Else it's on the network. – schroeder Jul 6 '20 at 13:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.