I have everything I host and expose behind authelia (which requires 2fa) as middleware or as the only login method with oicd, thus far it seems to work well, of course I get a bunch of malicious traffic and spam but this gets to authelia and stops there, I don’t even see multiple tried login tries ever so I felt pretty safe. However it does seem that everyone uses either fail2ban or crowdsec in addition so I have been wondering if it would really add any security in my setup or if I’m missing something. I’m sure it wouldn’t hurt but crowdsec always seemed a little too complex for me and I don’t want something I don’t fully understand in my security layer and I never saw a nice way to setup fail2ban so never bothered. Afaik there’s no webui or such things and you have to manually make working regex for everything. I’d like to know if I’m missing something or if anyone has tipps to give

  • hendrik@palaver.p3x.deEnglish
    10·
    20 hours ago

    Authelia should come with rate limiting to protect against brute-force attacks. That could be enough.

    I’d generally advise to make sure such protection actually works. Like look up the limits and try to login with a wrong password 30 times… Especially if you added stuff on top (fail2ban, crowdsec…). Has happened to me I misconfigured stuff and it didn’t limit anything… Now I check to make sure for important bits like an authentication service.

    • Midnight Wolf@lemmy.worldEnglish
      3·
      16 hours ago

      Do make sure that you can eventually get back in after testing, though. Sure, it’s safer when even you can’t access it, but… :p

      • hendrik@palaver.p3x.deEnglish
        1·
        16 hours ago

        Guess if it works, you don’t really need fail2ban as f2b pretty much does the same job. I mean it can do more, but you don’t really need to protect against PHP issues, broken wordpress plugins etc since none of that is part of Authelia.

        I use fail2ban, as I have SSH running and several other services exposed which come with default fail2ban configurations. And I never got crowdsec running properly. So I skipped it. I think frequent updates and all those things are more important than a web application firewall anyway.