5 ms·
Instead of rate limiting, more than a decade ago I started simply changing SSH port from 22 to something else. In case I needed to proxy through home, or acces
by techcode 2y ago
Instead of rate limiting, more than a decade ago I started simply changing SSH port from 22 to something else.
In case I needed to proxy through home, or access something like web ui for home heating system - I simply used ssh tunnel (socks localhost etc)...
Of course now all that is simply done via WireGuard/Tailscale/etc.
- lagniappe 2y agoI'd even go one step further and say portknocking would do a lot of good too, in addition to changing the default SSH port.
- techcode 2y agoIf anyone actually does this - please have a backup for the time when either Fail2Ban or/and PortKnocking (so both) fail or lock you out.
- lagniappe 2y agoI've never had knockd fail me, can you fill me in on what pitfall got yours to go down? Just in case.
- techcode 2y agoBesides dummy stuff like wrong config of knockd itself - which hopefully gets ironed out during initial (local/on-prem setup). Every now and then particular knock ports might be blocked (DROP) by cliënt side ISP/wifi/etc you happen to be using at the moment. Or your fiber optic connection package gets a speed boost, along with being moved behind CGNAT. OK in my case switching from cable to fiber already included ending up behind a CGNAT, but people already on that ISP actually got that 2in1 surprise.