I know what fail2ban does; it monitors the firewall logs and finds ip addresses that have too many failed logins to ssh; and then tells the firewall to drop packets from those addresses.
So is fail2ban an IPS?
I know what fail2ban does; it monitors the firewall logs and finds ip addresses that have too many failed logins to ssh; and then tells the firewall to drop packets from those addresses.
So is fail2ban an IPS?
IDS: Intrusion Detection System. IDS monitors a system for activity that would indicate unauthorized attempts to access that system, providing alerts for that activity but not changing the behavior of that system.
IPS: Intrusion Protection System. IPS monitors a system for activity that would indicate unauthorized attempts to access that system, reacting to that activity by changing the behavior of the system accordingly, beyond just alerts.
Using those definitions, fail2ban is absolutely an IPS because it changes the behavior of the system.