Comment on How to harden against SSH brute-forcing?
sugar_in_your_tea@sh.itjust.works 1 week ago
One of the simplest is geoip blocks. Here’s an article using iptables, and there may be a nicer way w/ whatever firewall you’re using.
For reference, here are the areas I see in your logs (using this service):
- 218.92.0.201 - China
- 162.142.125.122 - US (Michigan)
- 45.79.181.223 - US (New Jersey)
- 118.25.174.89 - China
- 92.118.39.73 - Romania
- 98.22.89.155 - US (Nebraska)
- 75.12.134.50 - US (Tennessee)
- 165.140.237.71 - US (Washington)
- 65.49.1.29 - US (California)
If you don’t expect valid users to come from those areas, block them. A lot of those in the US are probably from VPN users, so be careful if people are using a VPN to connect to your services.
If you can do it w/ iptables, it’ll be a lot more efficient than doing it at the application layer. I also recommend using something like fail2ban to block individual IPs within regions you care about to get any stragglers that make it through the first tier of blocks.
someacnt@sh.itjust.works 1 week ago
Thanks a lot! Geoblocking makes a lot of sense, will try!
sugar_in_your_tea@sh.itjust.works 1 week ago
I highly recommend using key-based SSH authentication exclusively for all users on your server, and disallow root login as well.
Geoblocking mostly cuts down on the spam, but also constrains where an actual attack can come from. If there’s some kind of zero-day attack on SSH, this will dramatically reduce the risk you’re hit.
someacnt@sh.itjust.works 1 week ago
Fortunately my VPS (oracle) has set SSH authentication to be default. Disallowing root login sounds good, gotta try that as well.