ini 13 lines · 1 tab

Fail2ban filters to slow SSH and application abuse

Kai Nakamura Apr 2026

1 tab

[sshd]
enabled = true
maxretry = 4
findtime = 10m
bantime = 1h

[nginx-auth]
enabled = true
port = http,https
logpath = /var/log/nginx/error.log
maxretry = 10
findtime = 5m
bantime = 30m

1 file · ini Explain with highlit

Fail2ban is not a complete defense, but it is a useful friction layer for noisy abuse. I use it where login failures or repeated 401s clearly indicate hostile automation. It works best when paired with centralized logs and upstream rate limiting, not as a magical perimeter shield.

Related snips

python

import os
import stat

for root, _dirs, files in os.walk('/etc'):
    for name in files:
        path = os.path.join(root, name)

Python security audit script for exposed risky filesystem state

python auditing host-security

by Kai Nakamura 1 tab

plaintext

Protocol 2
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
AllowUsers deploy ops

SSH daemon hardening and key based access only

ssh linux hardening

by Kai Nakamura 1 tab

ruby

class Rack::Attack
  throttle('logins/ip', limit: 5, period: 20.seconds) do |request|
    request.ip if request.path == '/users/sign_in' && request.post?
  end

  throttle('password_reset/email', limit: 3, period: 15.minutes) do |request|

Rate limiting abusive clients with Rack::Attack

rate-limiting rack-attack brute-force

by Kai Nakamura 1 tab

php

<?php

declare(strict_types=1);

namespace App\Security;

PHP Login Rate Limiting with a Sliding-Window Throttle Middleware

php rate-limiting middleware

by codesnips 3 tabs

Share this code

Here's the card — post it anywhere.

Fail2ban filters to slow SSH and application abuse — share card

Link copied