OPNsense Forum

English Forums => Intrusion Detection and Prevention => Topic started by: ruggerio on September 04, 2018, 12:12:39 pm

Title: Suricata as fail2ban replacement
Post by: ruggerio on September 04, 2018, 12:12:39 pm: Hi,

Fail2ban is tool, which detects e.g. bruteforce attacks to ssh, mailservers or equal.

My question is, if exist rulesets for suricata, which could also block ip's according to the attach pattern (e.g. 5 logins from the same source within 5 minutes or so...it would not be able to differ between successful or unsuccessful)

Thanks,
Roger
Title: Re: Suricata as fail2ban replacement
Post by: juliocbc on September 17, 2018, 12:45:48 am: Hello Ruggerio,

I think that will be done better with some HostIPS like OSSEC, for the bruteforce purpose.

Cheers!
Title: Re: Suricata as fail2ban replacement
Post by: ruggerio on September 18, 2018, 08:52:46 am: Yes, you are right, but it would be nice to have it centralized.

If it is not possible with Suricata, why not thinking about:

- Having a syslog-server on the opnsense-machine
- sending log-entries to opnsense
- opnsense having kind of fail2ban running and checking for the logs, blocking the offending ip's generally

instead of having each machine having its own IPS.
Title: Re: Suricata as fail2ban replacement
Post by: juliocbc on September 18, 2018, 12:32:56 pm: Seems to be a nice solution!

OSSEC have a agentless deployment too, and the advantage of it, in my point o view, is it can do more things like Filesystem Integrity Monitor, a lot of rulesets for log monitoring, etc.
Title: Re: Suricata as fail2ban replacement
Post by: Julien on September 30, 2018, 11:21:21 pm: i've been looking for this for long time.
is this OSSEC already availble in the packages ?
Title: Re: Suricata as fail2ban replacement
Post by: ruggerio on October 03, 2018, 01:12:34 pm: I don't think so. I will make a request on github, lets wait on the opinion of the devs.

I will link the request to this thread.

on github: https://github.com/opnsense/plugins/issues/887