Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I don't like fail2ban because with IPv6 it becomes useless.


It's still relevant even if you don't switch to network blocking. I haven't heard of any bots brute forcing over IPv6 yet, which will be much harder due to the size of the address space but those two aside...

A bot is unlikely to reconfigure the host's network stack to grab or rotate additional IPv6 addresses. That type of behaviour would be very easy to detect by endpoint protection systems and shut down.

When scanning, scraping, and/or brute forcing service passwords they're likely to remain using the same IPv6 address either permanently or on a daily rotation, most likely this will be mostly impacted by OS defaults on privacy addresses as I don't actually expect many normal users to know and/or care about them.

So if you're attacked on IPv6, you'll likely be equally protected by fail2ban as you are on IPv4.


That should be just a matter of making firewall blocks at least a /64, and considering scans/source-ips also as a netblock instead of individual ip's.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: