202-450 Exam QuestionsBrowse all questions from this exam

202-450 Exam - Question 84


Using its standard configuration, how does fail2ban block offending SSH clients?

Show Answer
Correct Answer: BC

Fail2ban blocks offending SSH clients by creating and maintaining netfilter rules. When Fail2ban detects a specified number of failed login attempts to SSH, it automatically modifies the iptables firewall configuration to drop packets from the offending IP addresses. This approach prevents further login attempts from these IPs by blocking them at the network level.

Discussion

10 comments
Sign in to comment
AdminguiOption: C
Jul 22, 2020

it should be C

usandoatiOption: C
Aug 3, 2020

The C is correct In reference is written: A service called Fail2ban can mitigate this problem by creating rules that automatically alter your iptables firewall configuration based on a predefined number of unsuccessful login attempts. This will allow your server to respond to illegitimate access attempts without intervention from you.

serlanOption: C
Dec 1, 2022

I think - C

serlanOption: C
Dec 1, 2022

C - ok

serlanOption: C
Dec 1, 2022

C - ok

LantosOption: C
May 14, 2023

It wouldn't be healthy if fail2ban would reconfigure the sshd:D

ArminaOption: B
Jan 24, 2022

B is correct, due to [sshd] configuration in /etc/fail2ban/jail.conf file. After installing the utility, there is a new configuration directory: /etc/fail2ban. The primary configuration file is the /etc/fail2ban/jail.conf file. In addition, there are sections for different jails. For example, you can have a section that relates to SSH connections, like the following: [sshd] enabled = true maxretry = 3 This is a simple example and there are many other possible features you can use in the section. For example, you could create a custom action rule, including sending someone an e-mail in the event the rule is used to block an IP address: [sshd] enabled = true maxretry = 3 action = iptables[name=SSH, port=ssh, protocol=tcp] sendmail-whois[name=SSH, dest=root, <a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="6112040f0504135c0700080d5303000f210419000c110d044f020e0c">[email protected]</a>] The action setting tells the fail2ban daemon what actions to take. The actions are normally defined in the /etc/fail2ban/action.d/iptables.conf file.

granatapfel
Sep 17, 2022

Armina, in your config you see "action = iptables" which means, fail2ban uses iptables to create a firewall block rule - which is Answer C.

MaikyCR28
Sep 10, 2023

Its's right that you have to configure the SSH service with Fail2ban in order Fail2ban can alter incoming connection to SSH, but at the end of the day Fail2ban blocks offending SSH clients by creating and mantaining netfilter rules, so the correct answer is C.

jorgevisentini
Jan 21, 2024

The right answer is C...

schifOption: C
May 2, 2022

The C is correct In reference is written: Fail2ban can mitigate this problem by creating rules that automatically alter your iptables firewall configuration based on a predefined number of unsuccessful login attempts.

granatapfelOption: C
Sep 17, 2022

I vote for C, see my comment on Armina

mira_Option: C
Oct 6, 2022

Qouting usandoati: The C is correct In reference is written: A service called Fail2ban can mitigate this problem by creating rules that automatically alter your iptables firewall configuration based on a predefined number of unsuccessful login attempts. This will allow your server to respond to illegitimate access attempts without intervention from you.