Good web ui for fail2ban that is mobile friendly?
Today I was round a friends house and had some old tv show playing (Columbo) I have on my jellyfin on in the background, I had a problem where the roku jellyfin client she was using was creating some 404's in the logs which then triggered my fail2ban ban ip…
Today I was round a friends house and had some old tv show playing (Columbo) I have on my jellyfin on in the background, I had a problem where the roku jellyfin client she was using was creating some 404's in the logs which then triggered my fail2ban ban ip rule. I then had to awkwardly remote in on my phone, unban her ip and stop the fail2ban service as a temporary workaround. Is there a good web gui for fail2ban that is mobile friendly? The ones I've just done a quick search for all look like they're desktop web orientated.
Collected discussion
Expand the replies to this comment to learn how AI was used in this post/project.
I already have a whitelist for my local network, this was at a friends house accessing it remotely from her internet connection. Also, do you have a link to warden? A quick search isn't showing me anything useful.
Maybe podwarden? https://www.podwarden.com/catalog/fail2ban I have no opinion, was looking for something similar for somw additional use cases.
You should not be downvoted for this. If locking legit clients out is such a frequent coincidence, i would rather rethink jail rules than installing yet another dedicated web service just for unbanning IPs. You are solving symptoms instead of the root cause. I would also agree that 404 do not belong in jail.
I noticed when I posted this yesterday there were some downvotes, no idea what's going on. Also, I typically have a very strict filter set to get rid of the scanners etc. At the moment I'm pondering to see if there's a way to set an exception rule as in if anything matches a subpath url that it doesn't block regardless if a specific filter is met. Okay, modified the filter: failregex = ^(?!.*jellyfin)<HOST>.*"(GET|POST).*" (404|444|403|400) .*$ Quick and dirty but should do the job.
I think it ultimately comes down to your use case and how strict you decide to be. For me fail2ban is almost exclusively used by me, most times I remote into my home network with a wireguard vpn. But I allow friends access to my jellyfin server through a reverse proxy with a cert via letsencrypt.
I think fail2ban has good use cases for protecting brute force to specific places, such as login pages of your web app. But most people use it to reduce noise in the SSH logs in the name of security, but it adds almost nothing there and it's more likely to lock you out. I recommend restricting access to SSH where you can (VPN, ip restriction, even subnets sometimes can work for dynamic ranges). And where you can't use SSH keys if you can, and long random passwords if you can't. The amount of time it would take to brute force even a 12 character random SSH password is years. There is a risk of zero days but I don't see fail2ban really protecting you there unless it's some timing attack.
Not very helpful on your first half an answer. Especially since the only thing is closed source? And no link or even a full product name.
id fix the jail before adding a ui tbh. a 404 from a logged in client isnt an auth failure, if your filter counts those youll keep banning your own users. mine only matches actual login failures now, after i banned myself twice
What do you suggest instead? Crowdsec?
yeah exactly. the jail config was the bug, the dashboard would have just made unbanning myself more comfortable
warden looks okay on mobile, the layout is simple enough that it scales down fine. not perfect but you can manage bans from a phone without wanting to throw it across the room also maybe set up a whitelist for your local network ip range, then you dont have to unban your friends every time some app goes haywire
I always wondered at what point whitelisting LAN doesn't add a big hole in the defense. It means if an attacker gets simple user access without ssh bruteforcing he then could try to bruteforce once in the LAN. You might say he could do worse. Or you could monitor for this kind of local brute force more seriously. But a safer alternative could be a breaking glass account.
I am using https://github.com/swissmakers/fail2ban-ui Good luck!
This is exactly why I don't recommend fail2ban. It's much more likely to lock out legit traffic than to prevent brute force. This is especially true against things like SSH, but using it against eg. Wordpress AJAX php or login pages might be ok, just put a timeout in.