I have everything I host and expose behind authelia (which requires 2fa) as middleware or as the only login method with oicd, thus far it seems to work well, of course I get a bunch of malicious traffic and spam but this gets to authelia and stops there, I don’t even see multiple tried login tries ever so I felt pretty safe. However it does seem that everyone uses either fail2ban or crowdsec in addition so I have been wondering if it would really add any security in my setup or if I’m missing something. I’m sure it wouldn’t hurt but crowdsec always seemed a little too complex for me and I don’t want something I don’t fully understand in my security layer and I never saw a nice way to setup fail2ban so never bothered. Afaik there’s no webui or such things and you have to manually make working regex for everything. I’d like to know if I’m missing something or if anyone has tipps to give

  • Arda@piefed.socialOPEnglish
    2·
    23 hours ago

    sure but if there would be an exploit in authelia would f2b even help, isnt the way it works that it blocks mostly spam and known bad traffic? If its already known by filterlists i feel its safe to assume its patched in authelia

    • IanTwenty@piefed.socialEnglish
      1·
      20 hours ago

      Say that new authelia exploit looks like one fail2ban already recognises or relies on timing/brute-force then you’re covered even before a patch is available.

      Here’s a real authelia vuln:

      https://app.opencve.io/cve/CVE-2026-47203

      allowing an attacker to circumvent login throttling or account lockouts by simply altering the case of their credentials.

      I think fail2ban would help protect authelia here?