Is Authelia enough without fail2ban or crowdsec?

Submitted ⁨⁨18⁩ ⁨hours⁩ ago⁩ by ⁨Arda@piefed.social⁩ to ⁨selfhosted@lemmy.world⁩

I have everything I host and expose behind authelia (which requires 2fa) as middleware or as the only login method with oicd, thus far it seems to work well, of course I get a bunch of malicious traffic and spam but this gets to authelia and stops there, I don’t even see multiple tried login tries ever so I felt pretty safe. However it does seem that everyone uses either fail2ban or crowdsec in addition so I have been wondering if it would really add any security in my setup or if I’m missing something. I’m sure it wouldn’t hurt but crowdsec always seemed a little too complex for me and I don’t want something I don’t fully understand in my security layer and I never saw a nice way to setup fail2ban so never bothered. Afaik there’s no webui or such things and you have to manually make working regex for everything. I’d like to know if I’m missing something or if anyone has tipps to give

original

Comments

Sort:hotnew top

jrgd@lemmy.zip ⁨18⁩ ⁨hours⁩ ago
Generally, your auth provider (assuming setup correctly) should be one of the most secure components of your internet-exposed setup. That being said, vulnerabilities can and do occur. Adding a combination of Crowdsec, OWASP CRS, other ModSecurity rulesets, and/or fail2ban will add a degree of migitation of potential exploits by blacklisting known bad actors/active bad behavior.

Above all, you should have a plan to keep aware of updates to your publicly-exposed software and be able to deploy those updates in a timely fashion.

original
folekaule@lemmy.world ⁨16⁩ ⁨hours⁩ ago
Fail2ban is just another tool in your toolbox. Defense in depth, as others mentioned.

Fail2ban is primarily a tool to prevent brute force attacks, especially useful for services that don’t do their own throttling. For example I usually put ssh in fail2ban, but if Authelia’s built-in protection is good enough, then use that.

Outside ssh, anything that could be used to brute force credentials should be in fail2ban if they’re exposed: web sites with simple auth, mail, etc.

original
Knossos@lemmy.world ⁨11⁩ ⁨hours⁩ ago
I used to have my system through CrowdSec and authentik. Now it’s Lan and Vpn only. Ai makes things too spicy for my liking.

original
hendrik@palaver.p3x.de ⁨18⁩ ⁨hours⁩ ago
Authelia should come with rate limiting to protect against brute-force attacks. That could be enough.

I’d generally advise to make sure such protection actually works. Like look up the limits and try to login with a wrong password 30 times… Especially if you added stuff on top (fail2ban, crowdsec…) has happened to me I misconfigured stuff and it didn’t limit anything… Now I check to make sure for important bits like an authentication service.

original
- wreckedcarzz@lemmy.world ⁨13⁩ ⁨hours⁩ ago
  Do make sure that you can eventually get back in after testing, though. Sure, it’s safer when even you can’t access it, but… :p
  
  original
- Arda@piefed.social ⁨16⁩ ⁨hours⁩ ago
  i do have ratelimiting configured but yes i never tested it which i should
  
  original
  - hendrik@palaver.p3x.de ⁨15⁩ ⁨hours⁩ ago
    Guess if it works, you don’t really need fail2ban as f2b pretty much does the same job. I mean it can do more, but you don’t really need to protect against PHP issues, broken wordpress plugins etc since none of that is part of Authelia.
    
    I use fail2ban, but I have SSH running and several other services exposed which come with default fail2ban configurations. And I never git crowdsec running. I think frequent updates and all those things are more important than a web application firewall anyway.
    
    original
frongt@lemmy.zip ⁨18⁩ ⁨hours⁩ ago
Security works in layers. You don’t know if there’s a vulnerability in Authelia.

original
- Arda@piefed.social ⁨16⁩ ⁨hours⁩ ago
  sure but if there would be an exploit in authelia would f2b even help, isnt the way it works that it blocks mostly spam and known bad traffic? If its already known by filterlists i feel its safe to assume its patched in authelia
  
  original
  - IanTwenty@piefed.social ⁨13⁩ ⁨hours⁩ ago
    Say that new authelia exploit looks like one fail2ban already recognises or relies on timing/brute-force then you’re covered even before a patch is available.
    
    Here’s a real authelia vuln:
    
    https://app.opencve.io/cve/CVE-2026-47203
    
    allowing an attacker to circumvent login throttling or account lockouts by simply altering the case of their credentials.
    
    I think fail2ban would help protect authelia here?
    
    original
DieserTypMatthias@lemmy.ml ⁨12⁩ ⁨hours⁩ ago
Please don’t expose your services to the internet directly. Use something like Tailscale/Headscale/whatever mesh VPN is relevant now. It’ll always be 100 times better than this and you wouldn’t worry about Authelia, f2b and CrowdSec (though updating your services and server(s) is always worth it).

original
- KairuByte@lemmy.dbzer0.com ⁨6⁩ ⁨hours⁩ ago
  “Okay mom, you need to install this VPN, log in, and make sure it’s on whenever you’re using Immich. Can you install it for Dad too? Now I’m going to call grandma back and explain that it isn’t a Deen Peen Em and she’s never going to find that.”
  
  There are times and places. The moment you want the non tech side of the family involved, a proper with server over the open internet is usually the better option.
  
  original
- Arda@piefed.social ⁨10⁩ ⁨hours⁩ ago
  It will not be a 100 times better than this, you’d need the vpn setup already on every client, how could others ever connect to it? Its also just cool to have a domain and expose it properly, I already use a vpn for admin only things
  
  original
  - crandall@lemmy.today ⁨9⁩ ⁨hours⁩ ago
    I also do this, you’re good
    
    original
ArseAssassin@sopuli.xyz ⁨16⁩ ⁨hours⁩ ago
Was thinking about the same thing before settling on mTLS. Seems like a fantastic defense so far.

original
- Arda@piefed.social ⁨16⁩ ⁨hours⁩ ago
  tell me more
  
  original
  - Ooops@feddit.org ⁨15⁩ ⁨hours⁩ ago
    It’s basically two-way TLS. It’s not only your server providing a certificate to prove it’s the real thing and not just some men-in-the-middle device or your connection for redirected, but the other side of the connection using the certificate, too, to show they are actually the devices allowed to communicate.
    
    So this basically revert the security. You are no longer trying to filter out access attempts when they show questionable behavior, but completely reject anything unless it’s explicitly authorized. Which of course only works when you or (a small number you can manually manage of) others access that stuff from fixed devices that you can set up properly.
    
    PS: For me fail2ban does basically something similiar. I have several web interfaces exposed via reverse proxy. But I barely ever use those interfaces manually; normally it’s via apps that access the services via that web interface. So things like failed authentifications or misstyped passwords don’t happen (unless when setting up something new maybe and then I’m there to unban a device manually if I screwed up). So fail2ban is set up to aggressively bans IPs for hours just for a single failed attempt.
    
    That’s keeping all those spammy bots looking for easy targets away very effectively, yet completely invisible for my legitimate use. After all that’s always the core issue: security vs. convenience. You build the best possible security that also doesn’t overly interferes with your normal use. Also the reason there is no on-size-fits-all solution because it’s about your use-case.
    
    original
    -> View More Comments
shininghero@pawb.social ⁨18⁩ ⁨hours⁩ ago
My network has all the web ui stuff kept local and only accessible via OpenVPN on port 443, with fail2ban as well.

By the time a would-be attacker realizes it’s not actually a webserver, they’ll have exhausted most, if not all, of their public IP addresses on fuzzing for webserver vulnerabilities.

original
CompactFlax@discuss.tchncs.de ⁨17⁩ ⁨hours⁩ ago
I am not a fan of geoblocking as a first line defense but when I blocked everything outside of my country, fail2ban stopped firing, entirely.

original
RIotingPacifist@lemmy.world ⁨12⁩ ⁨hours⁩ ago
Put as many layers in your onion as possible, also limit outbiund traffic which will make further exploration more difficult (especially if it’s an automated attack)

original