TheCompWiz
Well-known member
- Joined
- Apr 20, 2016
- Messages
- 142
- Points
- 18
Classic version of this: someone's mail client has an old password saved, retries every couple of minutes, trips the jail, and the ban is at firewall level so they lose the website too. From their side the site went down for no reason.
Worse when the office sits behind one NAT address. One misconfigured phone in the corner and everybody in the building is locked out, and nothing in the site logs explains it because the traffic never reached the site.
Adding them to ignoreip fixes the call and fixes nothing else. What helped more was treating the jails differently by what they protect. SSH stays strict because a wrong password there is not an accident. Mail and FTP get a longer window, a higher retry count and a ban measured in minutes, because the overwhelming majority of hits are customers with stale credentials rather than attackers.
The other change was making bans searchable, so that when someone calls I can say which jail caught them and why inside a minute instead of grepping around while they wait. Do you keep the mail jails as tight as SSH, or split them like this?
Worse when the office sits behind one NAT address. One misconfigured phone in the corner and everybody in the building is locked out, and nothing in the site logs explains it because the traffic never reached the site.
Adding them to ignoreip fixes the call and fixes nothing else. What helped more was treating the jails differently by what they protect. SSH stays strict because a wrong password there is not an accident. Mail and FTP get a longer window, a higher retry count and a ban measured in minutes, because the overwhelming majority of hits are customers with stale credentials rather than attackers.
The other change was making bans searchable, so that when someone calls I can say which jail caught them and why inside a minute instead of grepping around while they wait. Do you keep the mail jails as tight as SSH, or split them like this?
