Tuning fail2ban's recidive jail to stop distributed SSH brute-force attacks

·1 views

A server administrator noticed persistent SSH login attempts despite having fail2ban enabled and a non-default SSH port configured. The attacks used rotating IP addresses from domestic ISP dynamic IP ranges, evading standard fail2ban SSH jail rules. Investigation revealed that the default recidive jail settings were not suited to catch this slow, distributed pattern of repeated offenders. The administrator reconfigured the recidive jail, setting a 30-day observation window with a threshold of three prior bans to trigger a one-week long-term block. After the change, the 'Currently banned' count in the recidive jail began rising within days, with no false positives observed among legitimate users during the monitoring period.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Hugging Face silent rate-limiting mimics frozen downloads for anonymous users

Developers downloading large models from Hugging Face without authentication can experience downloads that appear to hang at 0 B/s, but are actually being silently rate-limited. Anonymous users share a quota of 3,000 requests per 5-minute window per IP address, meaning shared networks like office NATs or university connections deplete the limit faster. When the quota is exceeded, the Hub responds with a 429 status and a reset timer, while the huggingface_hub client quietly waits out the penalty without displaying any notification. The telltale sign is a fast initial burst followed by a consistent stall at the same point every retry — a pattern that signals a policy limit rather than a network failure. Setting a HF_TOKEN environment variable grants authenticated users higher rate limits and avoids the issue entirely.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build a Fault-Tolerant Rotating Proxy Pool in Python

Web scraping at scale requires more than a single proxy, as IPs can be rate-limited, banned, or timed out by target sites. A robust solution involves building a proxy pool in Python that rotates IPs on every request attempt and retries failed requests using a fresh IP. The approach treats HTTP status codes like 429 and 5xx as retryable errors and applies exponential backoff to avoid overwhelming struggling targets. For multi-step workflows such as logins or cart sessions, sticky sessions allow a fixed IP to persist by pinning a session ID in the proxy credentials. Switching between rotating and sticky modes covers most real-world scraping scenarios without requiring separate infrastructure.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why API Design Demands More Care Than Most Engineers Give It

A well-designed API functions as a binding promise to its consumers, making thoughtful upfront design critical to long-term system health. Every field or optional parameter added to an API increases complexity and the potential for bugs, meaning restraint is one of the most valuable qualities a designer can exercise. Consistency in naming, error formats, and pagination reduces hidden integration costs, while versioning is less about URL structure and more about clear change management and deprecation communication. APIs should also anticipate failure by providing meaningful error messages, correct status codes, and idempotent operations to improve resilience. When designed well, APIs enable teams to work independently; when designed poorly, they create tight coupling masked as a service.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five Contract Clauses That Cost Freelancers Money and How to Fight Back

Freelancers often lose income not through poor work but by overlooking harmful contract language before signing. Five common problem clauses include unlimited revision obligations, immediate IP transfer without payment, no cancellation or kill-fee terms, Net-60 payment windows, and broad non-compete restrictions spanning entire industries. Each clause can expose a freelancer to unpaid labor, loss of leverage, or being locked out of their primary market for up to two years. Experts recommend countering these with specific alternative language, such as capping revisions at two rounds, tying IP transfer to final payment, and limiting non-competes to named direct competitors for six months. Carefully reading every contract before signing remains one of the most valuable habits a freelancer can develop.

0 comments Read more at DEV Community