5 ms·
I've used Fail2Ban even with SSH password authentication turned off. It's still helpful for preventing huge error logs full of pointless password guesses. It's
by knyt 12y ago
I've used Fail2Ban even with SSH password authentication turned off. It's still helpful for preventing huge error logs full of pointless password guesses.
It's also useful for applications where you have to use passwords or where you need to allow anonymous requests but you don't want attackers using up all of your resources. VoIP (public-facing and handset-facing SIP) servers are my example of both of those situations.
- justizin 12y agoright, anyone who has undergone frequent ssh brute force attacks knows that they can create a nontrivial amount of cpu usage.
- atmosx 12y agoPractically evert open 22 port receives a huge amount of scripted attacks these days.
- qnaal 12y ago"stop coming to my house Internet, I just want to stay friends"
- jqm 12y agoWhich is why a port other than 22 is pretty good practice.
- rtehfm 12y agoExcept when programs are designed for SSH to communicate on port 22. Security by obscurity is not good practice but other than that, yes, using a non standard SSH port will greatly reduce random drive by attempts.
- tadfisher 12y agoThe proper method of dealing with programs like that is to fix them or use other programs.
- atmosx 12y agoJust configure the localhost to route the ssh connections over a different port. Combined with ssh keys an becomes extremely convenient setup e.g.: ~> cat .ssh/config ControlMaster auto ControlPath /tmp/%r@%h:%p ControlPersist yes Host hostname1 IdentityFile ~/.ssh/id_rsa Hostname rem.hostname1.com Port 2290 user user_name Now you can things like: git clone ssh://username@hostname1/home/user/Code/repot.git or scp file1.tar hostname1:/home/username && sftp hostname1 Which is pretty handy :-)
- rlpb 12y ago"There's No Protection In High Ports Anymore. If Indeed There Ever Was." http://bsdly.blogspot.co.uk/2013/02/theres-no-protection-in-high-ports.html http://bsdly.blogspot.co.uk/2013/02/theres-no-protection-in-...
- nikatwork 12y agoUnless the majority of ssh brute force attacks iterate over every port value, using a non-standard port would still have value in reducing the volume of attacks.
- jimktrains2 12y agoIt's less protection and more just avoiding aimless attacks. If someone's out to get you, then sure, they'll find the port. If someone's out to just find any unlocked door, they'll just move on.
- feld 12y agoI changed my mail server to listen on port 26 and now I don't get spam anymore