i do have ratelimiting configured but yes i never tested it which i should
Comment on Is Authelia enough without fail2ban or crowdsec?
hendrik@palaver.p3x.de 1 day ago
Authelia should come with rate limiting to protect against brute-force attacks. That could be enough.
I’d generally advise to make sure such protection actually works. Like look up the limits and try to login with a wrong password 30 times… Especially if you added stuff on top (fail2ban, crowdsec…) has happened to me I misconfigured stuff and it didn’t limit anything… Now I check to make sure for important bits like an authentication service.
Arda@piefed.social 1 day ago hendrik@palaver.p3x.de 1 day ago
Guess if it works, you don’t really need fail2ban as f2b pretty much does the same job. I mean it can do more, but you don’t really need to protect against PHP issues, broken wordpress plugins etc since none of that is part of Authelia.
I use fail2ban, but I have SSH running and several other services exposed which come with default fail2ban configurations. And I never git crowdsec running. I think frequent updates and all those things are more important than a web application firewall anyway.
Do make sure that you can eventually get back in after testing, though. Sure, it’s safer when even you can’t access it, but… :p