So…
IDS’s. Who’s got knowledge of a good choice for a private server? Preferably open source.
Is snort still a good choice?
Are there any integrating modules for Webmin like the CSF module?
Any tips on penetration tests (stop laughing in the back row!).
Namaste
Fail2Ban is more classed as an IPS (Intrusion Prevention System).
CHAT GPT seems to think…
User question
Is fail2ban an IDS?
ChatGPT
Fail2Ban is not a traditional Intrusion Detection System (IDS) but rather an Intrusion Prevention System (IPS). While both IDS and IPS are security measures used to protect computer systems and networks from unauthorized access or malicious activities, they have different approaches.
Intrusion Detection System (IDS):
IDS monitors and analyzes network or system activities for signs of malicious behavior or security policy violations.
It operates in a detection-only mode, meaning it identifies and alerts about potential threats but does not take direct action to prevent them.
IDS can be network-based or host-based, depending on whether it monitors network traffic or activities on individual systems.
Intrusion Prevention System (IPS):
IPS, on the other hand, not only detects malicious activities but also takes proactive measures to prevent them.
It can block or prevent malicious activities in real-time by actively intervening in the network or system processes.
Fail2Ban falls into this category because it actively responds to detected malicious behavior by blocking IP addresses, thereby preventing further unauthorized access.
Fail2Ban:
Fail2Ban is specifically designed to protect against unauthorized access attempts by monitoring log files for patterns indicative of a potential security threat, such as repeated failed login attempts.
When it detects such patterns, it can automatically update firewall rules to block the source IP addresses of the potential attackers.
While Fail2Ban is not a full-fledged IDS, it provides a level of intrusion prevention by responding to specific events that may indicate malicious intent.
In summary, Fail2Ban is more aligned with the functionality of an IPS, as it actively takes measures to prevent unauthorized access by blocking potentially malicious IP addresses.
I think SNORT may be more network oriented as it mainly sniffs on a promiscuous port at the switch level. Virtualmin is pretty good ‘as is’ for security. IDS for a private server is pretty much overkill and resource intensive. It all depends on the ‘why’.
I know I used to use some software that alerted me to file system changes. It was always fun to run after an update. 
Bottom line, unless you are running something that is a prime target for skilled thieves to salivate at, basic good security measures are generally good enough.
Be as secure as possible for GDPR compliance.
Webmin does have excellent CSF integration:
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.