centos9 or el9/rocky9
Sorry for posting off topic, a bit to lazy to create yet another account somewhere. I still need to make this upgrade to different os. I have now some vms on centos9 stream. What annoys me a lot is that tcp wrapper support is not default added to ssh. (I am using auto fed dns blacklists to refuse access) Can anyone tell me if this is the same in el9/rocky9?
On Wed, Oct 23, 2024 at 5:12 AM Marc <Marc@f1-outsourcing.eu> wrote:
Sorry for posting off topic, a bit to lazy to create yet another account somewhere. I still need to make this upgrade to different os. I have now some vms on centos9 stream. What annoys me a lot is that tcp wrapper support is not default added to ssh. (I am using auto fed dns blacklists to refuse access)
Can anyone tell me if this is the same in el9/rocky9?
I use fail2ban for this purpose on CentOS Stream 9. It works with firewalld.
Sorry for posting off topic, a bit to lazy to create yet another account somewhere. I still need to make this upgrade to different os. I have now some vms on centos9 stream. What annoys me a lot is that tcp wrapper support is not default added to ssh. (I am using auto fed dns blacklists to refuse access)
Can anyone tell me if this is the same in el9/rocky9?
I use fail2ban for this purpose on CentOS Stream 9. It works with firewalld.
Yes on one host not? It is not like if host a is being harassed and blacklists, all hosts are having this update. I am using remote syslog with fail2ban -> dns update -> dns checks on all hosts. Or does firewalld allow for some remote updates?
Is this moot if the Ceph daemon nodes are numbered in RFC1918 space or otherwise not reachable from the internet at learge?
Sorry for posting off topic, a bit to lazy to create yet another account somewhere. I still need to make this upgrade to different os. I have now some vms on centos9 stream. What annoys me a lot is that tcp wrapper support is not default added to ssh. (I am using auto fed dns blacklists to refuse access)
Can anyone tell me if this is the same in el9/rocky9?
I use fail2ban for this purpose on CentOS Stream 9. It works with firewalld.
Yes on one host not? It is not like if host a is being harassed and blacklists, all hosts are having this update. I am using remote syslog with fail2ban -> dns update -> dns checks on all hosts. Or does firewalld allow for some remote updates? _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
Hi Marc, Make sure you have a look at CrowdSec [1] for distributed protection. It's well worth the time. Regards, Frédéric. [1] https://github.com/crowdsecurity/crowdsec ________________________________ De : Marc <Marc@f1-outsourcing.eu> Envoyé : jeudi 24 octobre 2024 22:52 À : Ken Dreyer Cc: ceph-users Objet : [ceph-users] Re: centos9 or el9/rocky9
Sorry for posting off topic, a bit to lazy to create yet another account somewhere. I still need to make this upgrade to different os. I have now some vms on centos9 stream. What annoys me a lot is that tcp wrapper support is not default added to ssh. (I am using auto fed dns blacklists to refuse access)
Can anyone tell me if this is the same in el9/rocky9?
I use fail2ban for this purpose on CentOS Stream 9. It works with firewalld.
Yes on one host not? It is not like if host a is being harassed and blacklists, all hosts are having this update. I am using remote syslog with fail2ban -> dns update -> dns checks on all hosts. Or does firewalld allow for some remote updates? _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
There is a certain virtue in using a firewall appliance for front-line protection. I think fail2ban could add IPs to its block list. An advantage of this is that you don't have to remember what all the internal servers are to firewall them individually. Certainly one could update firewall-cmd via ssh. I do this as part of my Ansible provisioning. You could, in fact, set up a blocklist file with banned IPS that Ansible could run against at intervals and do bulk host updates that way. Tim On Fri, 2024-10-25 at 06:32 +0200, Frédéric Nass wrote:
Hi Marc,
Make sure you have a look at CrowdSec [1] for distributed protection. It's well worth the time.
Regards, Frédéric.
[1] https://github.com/crowdsecurity/crowdsec
________________________________ De : Marc <Marc@f1-outsourcing.eu> Envoyé : jeudi 24 octobre 2024 22:52 À : Ken Dreyer Cc: ceph-users Objet : [ceph-users] Re: centos9 or el9/rocky9
Sorry for posting off topic, a bit to lazy to create yet another account somewhere. I still need to make this upgrade to different os. I have now some vms on centos9 stream. What annoys me a lot is that tcp wrapper support is not default added to ssh. (I am using auto fed dns blacklists to refuse access)
Can anyone tell me if this is the same in el9/rocky9?
I use fail2ban for this purpose on CentOS Stream 9. It works with firewalld.
Yes on one host not? It is not like if host a is being harassed and blacklists, all hosts are having this update. I am using remote syslog with fail2ban -> dns update -> dns checks on all hosts. Or does firewalld allow for some remote updates? _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
participants (5)
-
Anthony D'Atri
-
Frédéric Nass
-
Ken Dreyer
-
Marc
-
Tim Holloway