Botnet attacks - Fail2ban useless!

The attacks have become more and more sophisticated lately, I took a closer look at the logs today and found that most attacks are now being carried out via botnets. The IP addresses are therefore changing every minute and a blocking via Fail2ban is becoming difficult without locking out regular customers.

So Fail2ban is bypassed by botnets and another solution is needed ...

does anyone have an idea?

check out:

tail -n 50000 /var/log/fail2ban.log | grep wordpress

tail -n 50000 /var/log/fail2ban.log | grep postfix

tail -n 50000 /var/log/fail2ban.log | grep postfix

tail -n 50000 /var/log/fail2ban.log | grep dovecot

tail -n 50000 /var/log/fail2ban.log | grep postfix-sasl

etc.

Quote from Athar

Not a perfect solution, but if all the IPs are from countries you don't work with (or your customers), block the whole country 😅

Thanks, I'm already using such country ipsets, this case is difficult because each request comes from a different IP address & country.

I'm trying to improve my jail.local to block repeat offenders w/ increased ban times:

http://blog.shanock.com/fail2b…mes-for-repeat-offenders/

However, filtering and blocking a huge botnet is almost impossible ...

hmm, works but only with a high CPU load due to the findtime 1d, 1w etc. F2B is running with 100% CPU load ... so it's not a good solution

that's what I mean

the IP address does not appear twice on the same day ...

and in the background all possible passwords can be tested, day after day

one more blacklist:

https://feodotracker.abuse.ch/blocklist/

Quote from mrpink

I switched from fail2ban to crowdsec. And with one of the next releases also blocklists will be supported within crowdsec.

CrowdSec - The open-source & collaborative IPS

Can CrowdSec completely replace fail2ban actions and should fail2ban be removed when using CrowdSec?

Do you have good experiences with it and does it work better than fail2ban?