42
Is Authelia enough without fail2ban or crowdsec? (piefed.social)
submitted 1 day ago by to c/selfhosted@lemmy.world
24 comments fedilink hide all child comments
 

I have everything I host and expose behind authelia (which requires 2fa) as middleware or as the only login method with oicd, thus far it seems to work well, of course I get a bunch of malicious traffic and spam but this gets to authelia and stops there, I don't even see multiple tried login tries ever so I felt pretty safe. However it does seem that everyone uses either fail2ban or crowdsec in addition so I have been wondering if it would really add any security in my setup or if I'm missing something. I'm sure it wouldn't hurt but crowdsec always seemed a little too complex for me and I don't want something I don't fully understand in my security layer and I never saw a nice way to setup fail2ban so never bothered. Afaik there's no webui or such things and you have to manually make working regex for everything. I'd like to know if I'm missing something or if anyone has tipps to give

you are viewing a single comment's thread
view the rest of the comments
[–] 3 points 1 day ago* (last edited 1 day ago)

My network has all the web ui stuff kept local and only accessible via OpenVPN on port 443, with fail2ban as well.

By the time a would-be attacker realizes it's not actually a webserver, they'll have exhausted most, if not all, of their public IP addresses on fuzzing for webserver vulnerabilities.

EDIT: and as a bonus, I can also just punch out through the firewall my work has on the visitor network with ease. All I needed was a second fail2ban rule for their static IP to deal with followup scans.

  • permalink
  • fedilink
  • source
    •