[pfSense] fail2ban

2013-10-10 Thread Aristedes Maniatis
We get a lot of attempts to guess weak ftp passwords on our servers. A tool which we've used before (and is really nice) is fail2ban. In response to a certain type or number of failed attempts, it can run a script (for example, to load a firewall rule blocking that user). However, we'd ideally

Re: [pfSense] fail2ban

2013-10-10 Thread mayak
On 10/10/2013 09:01 AM, Aristedes Maniatis wrote: > We get a lot of attempts to guess weak ftp passwords on our servers. A tool > which we've used before (and is really nice) is fail2ban. In response to a > certain type or number of failed attempts, it can run a script (for example, > to load a

Re: [pfSense] fail2ban

2013-10-10 Thread Ermal Luçi
On Thu, Oct 10, 2013 at 9:01 AM, Aristedes Maniatis wrote: > We get a lot of attempts to guess weak ftp passwords on our servers. A > tool which we've used before (and is really nice) is fail2ban. In response > to a certain type or number of failed attempts, it can run a script (for > example, to

Re: [pfSense] fail2ban

2013-10-10 Thread Yehuda Katz
We use Fail2Ban with pfSense with a custom php script (on the firewall) that adds the appropriate firewall rules. We have fail2ban set up with multiple levels - so the action to ban in pfSense only happens after several attempts at other services on one machine. That way we can assume the ban shoul

Re: [pfSense] fail2ban

2013-10-10 Thread Jostein Elvaker Haande
On 10 October 2013 16:08, Yehuda Katz wrote: > We use Fail2Ban with pfSense with a custom php script (on the firewall) > that adds the appropriate firewall rules. > We have fail2ban set up with multiple levels - so the action to ban in > pfSense only happens after several attempts at other servic

Re: [pfSense] fail2ban

2013-10-10 Thread Vick Khera
On Thu, Oct 10, 2013 at 10:37 AM, Jostein Elvaker Haande wrote: > I've talked to the development team about this in the past, and what I was > told back then was this: with 1.3, you could achieve an API like behavior > with using curl or similar tools, but this would be close to impossible > with