Comment

Comment on How to harden against SSH brute-forcing?

We can’t ever stop this kind of stuff, but with something like fail2ban you can set it up to block on too many failures.

Really though - ensuring your system is kept up to date and uses strong passwords or use a SSH keys is the best defence. Blocking doesn’t prevent them from trying a few times. Moving SSH to a non standard port will stop most of the automated attacks but it won’t stop someone who is dedicated.

source

Sort:hotnew top

30p87@feddit.org ⁨1⁩ ⁨week⁩ ago
Move SSH to non-standard port, make endlessh use the default port. Only use SSH keys. Only allow correct users (so eg. your user and git/forgejo). Use fail2ban to aggressively ban (redirect to default port, so 22) and report to abuseipdb everything that fails to authenticate first try (wrong user, password instead of key), has non-compatible ciphers (generally, only allow TLS1.3 etc.), or fails in any other way. Just be sure that if you accidentally get banned yourself (eg. Ctrl+C-ing during authentication), you can use another IP (eg. force v4) for connecting.

source
- cron@feddit.org ⁨1⁩ ⁨week⁩ ago
  Nice list of suggestions, but implementing all of them feels a little over-the-top.
  
  source
  - 30p87@feddit.org ⁨1⁩ ⁨week⁩ ago
    Tbh, I myself still have SSH on port 22. Firstly, because I’m lazy, and secondly … yeah that’s it. I’m honestly just lazy. But spam bots trying office/cookie123 are not a real threat, and anyone trying to actually target me will either have somehow acquired my key + password, use one of the probably many security issues that exist in the dozen services I selfhost, social engineer me into doing something (not saying I’ve given out my (old) KeePass password once, but it could be, as love makes blind (I still love her)), or just smash my kneecaps until I give out everything.
    
    source
- bigBananas@feddit.nl ⁨1⁩ ⁨week⁩ ago
  Also, add 2FA
  
  source
  - 30p87@feddit.org ⁨1⁩ ⁨week⁩ ago
    But remember, on a third device. Not the one where your KeePass DB is one fingerprint away, and your private SSH key too.
    
    source
someacnt@sh.itjust.works ⁨1⁩ ⁨week⁩ ago
Thanks, I will try fail2ban. I am using ED25519 for ssh keys, it seems like it’s the best defense on the ssh side. Do you happen to know why this kind of attack is so prevalent?

source
- WhyJiffie@sh.itjust.works ⁨1⁩ ⁨week⁩ ago
  I’m not them, but among other reasons they are looking to build botnets (cryptomining, dosing, mass crawling), and they are searching for hosts with low security (or if you just made a mistake)
  
  source