IP Security Logs

[fabaff (Fabian Affolter)]

With fail2ban (see here) is a solution available that is doing the blocking automatically.

@Masterautomate

A persistent notification is a nice idea but they could pile up fast if some one really went after the login with something like a dictionary attack.

True, but as we can use the same ID. So only the last one will be visible.

@Masterautomate

How long would it take you to find a failed login attempt in your log files unless you are running grep on your log output looking for it.

Not that long because my log file is basically empty on the productive instance.

@Masterautomate

How many users know how to do that? If its half then the other half have no way of knowing if anything has happened and if they are getting pen tested.

Well, we need to assume that people who are exposing their systems to the wild know that they are doing. Especially when it comes down to securing the communication channel, the logging, and the access itself.

@Masterautomate

Lets not “obscure” the security data in the system logs just to keep things simple.

The warnings are not buried in the system logs. Home Assistant is keeping its own log file which makes it much more accessible than the classical approach of using /var/log/. For that we have the syslog notify platform that would allow to hook Home Assistant’s logging into the system’s one.