samba - Dec 2021 - Fail2Ban for AD

On Sat, 2021-12-11 at 22:33 -0500, Philippe LeCavalier via samba
wrote:
> On Sat, Dec 11, 2021 at 4:23 AM Andrea Venturoli via samba <
> samba at lists.samba.org> wrote:
> 
> > On 12/11/21 01:33, Philippe LeCavalier via samba wrote:
> > > Hi,
> > 
> > Hello.
> > 
> > 
> > 
> > > Has anyone here implemented fail2ban? If so, what has your
> > > experience
> > been
> > > thus far?
> > 
> > What for? Failed authentications?
> > 
> > 
> > Or ransomware protection?
> > 
> No just for failed logins . The lockout will create DoS and I'm
> seeing way more failed logins than I like.
https://wiki.samba.org/index.php/Setting_up_Audit_Logging was
specifically intended to provide enough detail to allow this kind of
thing.

Andrew Bartlett

-- 
Andrew Bartlett (he/him)       https://samba.org/~abartlet/
Samba Team Member (since 2001) https://samba.org
Samba Team Lead, Catalyst IT   https://catalyst.net.nz/services/samba

Samba Development and Support, Catalyst IT - Expert Open Source
Solutions

On Sun, Dec 12, 2021, 11:55 Andrew Bartlett <abartlet at samba.org> wrote:
> On Sat, 2021-12-11 at 22:33 -0500, Philippe LeCavalier via samba wrote:
> > On Sat, Dec 11, 2021 at 4:23 AM Andrea Venturoli via samba <
> > samba at lists.samba.org> wrote:
> >
> > > On 12/11/21 01:33, Philippe LeCavalier via samba wrote:
> > > > Hi,
> > >
> > > Hello.
> > >
> > >
> > >
> > > > Has anyone here implemented fail2ban? If so, what has your
> > > > experience
> > > been
> > > > thus far?
> > >
> > > What for? Failed authentications?
> > >
> > >
> > > Or ransomware protection?
> > >
> > No just for failed logins . The lockout will create DoS and I'm
> > seeing way more failed logins than I like.
>
> https://wiki.samba.org/index.php/Setting_up_Audit_Logging was
> specifically intended to provide enough detail to allow this kind of
> thing.
>
> Andrew Bartlett
>
> Sorry Andrew, could you clarify? Are you saying samba has the ability to
> ban per public IP or just the the log sys doesn't need to be redirected
to
> use fail2ban