[{"data":1,"prerenderedAt":241},["ShallowReactive",2],{"project-7951071":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":34,"aspects":35,"strip":39,"post_text":41,"what":42,"said":80,"maker_in_thread":164,"shape":171,"grid":175,"attempts":201,"same_week":202,"maker_shows":232,"maker_hidden":233,"reader_version":234,"card":235},"7951071","Fail2web","A fail2ban GUI","title","Show HN: Fail2web, a fail2ban GUI","https:\u002F\u002Fgithub.com\u002FSean-Der\u002Ffail2web","github.com","Sean-Der",1403809240,2014,48,14,671,2272,30,"shown","infrastructure","server security administration","web_app",[24,25,26,27],"fail2ban","web gui","ssh security","iptables","debated",-0.071,{"positive":31,"neutral":32,"mixed":33,"critical":31},2,0,1,5,{"design":36,"idea":37,"execution":38},{"positive":32,"critical":32},{"positive":31,"critical":33},{"positive":32,"critical":33},[32,40,32,33,32,32,34,32,32,32,32,32,33,34],3,null,{"problem":43,"audience":50,"pricing":41,"motivation":57,"time_to_build":41,"stack":61,"openness":78,"stage":79,"team_size":79},{"value":44,"source":45,"evidence":46},"Users accidentally ban themselves in fail2ban and find unbanning via fail2ban-client awkward","maker",[47],{"id":48,"by":11,"text":49},"7951073","fail2ban is one the most under appreciated tools on small to medium Unix servers. I was first introduced to it when administering some web facing Asterisk servers (FreePBX) and…",{"value":51,"source":45,"evidence":52},"Sysadmins running small to medium Unix servers, such as Asterisk\u002FFreePBX installs",[53,54],{"id":48,"by":11,"text":49},{"id":55,"by":11,"text":56},"7952556","If you are in a real production environment you shouldn't be opening up SSH to the world, most people that are accessing SSH have enough know how tunnel through a VPN. So for…",{"value":58,"source":45,"evidence":59},"Frustration of field users who disabled fail2ban after accidental bans",[60],{"id":48,"by":11,"text":49},[62,66,70,74],{"value":63,"source":45,"evidence":64},"Go (fail2go library, fail2rest REST server)",[65],{"id":48,"by":11,"text":49},{"value":67,"source":45,"evidence":68},"Python (fail2ban process exposing pickled socket output)",[69],{"id":48,"by":11,"text":49},{"value":71,"source":45,"evidence":72},"AngularJS with angular-ui and browserify",[73],{"id":48,"by":11,"text":49},{"value":75,"source":45,"evidence":76},"og-rek pickle library",[77],{"id":48,"by":11,"text":49},"open_source","unknown",{"praise":81,"objections":98,"requests":123,"questions":135,"alternatives":143},[82,91],{"value":83,"source":84,"evidence":85},"fail2ban is underappreciated and useful for small servers","commenter",[86,87],{"id":48,"by":11,"text":49},{"id":88,"by":89,"text":90},"7951236","bhhaskin","Nice! I will have to give it a go sometime. unbanning from fail2ban is always a pain.",{"value":92,"source":84,"evidence":93},"A web UI would help less experienced sysadmins",[94],{"id":95,"by":96,"text":97},"7952164","fred_durst","Yes, the reality is that \"baseball\" is a bad password, and ssh as root is a bad idea but getting auth.log spammed into oblivion is also a bummer. It feels like a web GUI would…",[99,106,113,117],{"value":100,"source":84,"evidence":101},"Fail2ban adds little security for SSH; key-based or other auth is better",[102],{"id":103,"by":104,"text":105},"7951958","akerl_","Exactly what fail2ban needed: a web UI for people to exploit. If I could eliminate any Linux service, it would probably be fail2ban. As an SSH security measure, it's more than…",{"value":107,"source":84,"evidence":108},"Extra components add complexity and risk of locking yourself out",[109],{"id":110,"by":111,"text":112},"7951224","gingerlime","Thanks for making it. I'd like to give it a try some time. I certainly share your feeling about the awesomeness of fail2ban, as well as the slight awkwardness of interacting with…",{"value":114,"source":84,"evidence":115},"A web UI could be an attack surface",[116],{"id":103,"by":104,"text":105},{"value":118,"source":84,"evidence":119},"Fail2ban log parsing can be overloaded by attackers",[120],{"id":121,"by":104,"text":122},"7952392","It uses iptables, but it detects things to block by reading log files, and it's not exactly efficient in doing so. As such, if an attacker can pump lines in (like by having their…",[124,131],{"value":125,"source":84,"evidence":126},"Support Internet Explorer (window.location.origin missing)",[127],{"id":128,"by":129,"text":130},"7955897","djengineerllc","So this looks like it will be pretty neat. I have it compiled and running. It seems to be mostly working. I did run into some issues. Like for instance, in the bundle.js file…",{"value":132,"source":84,"evidence":133},"Fix ban updates returning empty IP list from fail2rest",[134],{"id":128,"by":129,"text":130},[136],{"value":137,"source":84,"evidence":138},"How fail2ban locks users out or gets overloaded given it uses iptables",[139],{"id":140,"by":141,"text":142},"7952042","ChikkaChiChi","I thought Fail2Ban hooked directly into iptables? How would you get locked out or overloaded? I don't necessarily think Fail2Ban needed a GUI, but I guess I never thought it was…",[144,148,156,160],{"value":145,"source":84,"evidence":146},"fwknop single packet authorization",[147],{"id":103,"by":104,"text":105},{"value":149,"source":84,"evidence":150},"google_authenticator PAM TOTP",[151,152],{"id":103,"by":104,"text":105},{"id":153,"by":154,"text":155},"7952220","ryan-c","Add http:\u002F\u002Fwww.heiho.net\u002Fpam_shield\u002F and http:\u002F\u002Fwww.snafu.priv.at\u002Fmystuff\u002Fpam_recent.c to that list. I use use some iptables voodoo with them to auto-whitelist on successful auth…",{"value":157,"source":84,"evidence":158},"knockknock single packet auth",[159],{"id":103,"by":104,"text":105},{"value":161,"source":84,"evidence":162},"pam_shield and pam_recent with iptables",[163],{"id":153,"by":154,"text":155},{"comments":40,"answered":32,"key":165},[166,167,170],{"id":48,"text":49},{"id":168,"text":169},"7951304","I defiantly hear your concern about there being lots of moving parts. I thought about having one monolithic platform that you could drop and run to help deployment ease. But…",{"id":55,"text":56},{"commenters":172,"max_depth":173,"maker_replies":40,"first_comment_mins":32,"lifespan_hours":174},8,4,152,[176,178,180,182,184,186,188,189,191,192,194,196,198,200],[48,32,32,177,11,33],"project\u002Fpositive\u002Fidea",[110,32,40,179,111,32],"project\u002Fmixed\u002Fdesign",[168,32,32,181,11,33],"maker\u002Fneutral\u002Fdesign",[103,33,33,183,104,32],"project\u002Fcritical\u002Fidea",[140,33,32,185,141,32],"commenter\u002Fneutral\u002Fnone",[121,33,32,187,104,32],"commenter\u002Fneutral\u002Fperformance",[95,33,34,177,96,32],[190,33,32,185,104,32],"7952406",[153,33,32,185,154,32],[193,33,32,185,104,32],"7952407",[195,33,32,185,154,32],"7981160",[55,33,32,197,11,33],"commenter\u002Fcritical\u002Fidea",[128,31,33,199,129,32],"project\u002Fcritical\u002Fexecution",[88,40,34,177,89,32],[],[203,208,213,217,222,227],{"id":204,"name":205,"points":206,"category":207},"7978075","interviewing.io",604,"learning_science",{"id":209,"name":210,"points":211,"category":212},"7951020","Vim Awesome",222,"dev_tools",{"id":214,"name":215,"points":216,"category":207},"7965784","Instinct",218,{"id":218,"name":219,"points":220,"category":221},"7954327","Grasswire",115,"productivity",{"id":223,"name":224,"points":225,"category":226},"7976749","Iron",81,"languages",{"id":228,"name":229,"points":230,"category":231},"7973784","Bayes Impact",80,"other",19,false,"v2",{"id":236,"name":5,"line":6,"ai":233,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":237,"top":18,"kw":238,"maker":11,"domain":10,"tier":19,"attempts":32,"strip":239,"url":9,"mix":240,"praise":83,"objection":100,"sub":21},7951071,-0.07,[24,25,26,27],"03010050000015",[31,32,33,31],1794036519269]