Comment 10 for bug 1406996

Revision history for this message
Ro (robert-markula) wrote :

I'd second the downvote as an security issue.

Fail2ban's purpose is to block brute-force attacks. People installing this software rely on it to do just that. But immediately after the first logrotate, fail2ban will silently stop blocking brute-force attacks, letting attackers cross security boundaries that have been set up to do exactly that. All this while the user thinks itself safe.

Brute-force SSH attacks are extremely common and can lead to system break-ins sooner or later.

A security software that silently blacks out without any indication or warning of doing so, is dangerous. And a bug provoking this behaviour is a security issue after all.

I would not dare to count how many users out there are not aware that their fail2ban installation isn't working as expected, involuntarily facilitating brute-force attacks.