Comment

Comment on Basic Security for your Website | Loudwhisper

vext01@lemmy.sdf.org ⁨3⁩ ⁨months⁩ ago

I recall hearing that openssh has something like fail2ban built-in now. I forget the name of the feature.

source

Sort:hotnew top

loudwhisper@infosec.pub ⁨3⁩ ⁨months⁩ ago
AFAIK I know that SSH has MaxAuthTries and LoginGraceTime, but all it does is terminating the SSH session (I.e. slow down at most), it won’t block the IP via firewall or configuration.

Not sure if there is a recent feature that does the same.

source
- vext01@lemmy.sdf.org ⁨3⁩ ⁨months⁩ ago
  It’s this (excuse formatting): www.openssh.com/releasenotes.html
  
  sshd(8) will now penalise client addresses that, for various reasons, do not successfully complete authentication. This feature is controlled by a new sshd_config(5) PerSourcePenalties option and is on by default.
  
  sshd(8) will now identify situations where the session did not authenticate as expected. These conditions include when the client repeatedly attempted authentication unsucessfully (possibly indicating an attack against one or more accounts, e.g. password guessing), or when client behaviour caused sshd to crash (possibly indicating attempts to exploit bugs in sshd).
  
  When such a condition is observed, sshd will record a penalty of some duration (e.g. 30 seconds) against the client’s address. If this time is above a minimum configurable threshold, then all connections from the client address will be refused (along with any others in the same PerSourceNetBlockSize CIDR range) until the penalty expire.
  
  Repeated offenses by the same client address will accrue greater penalties, up to a configurable maximum. Address ranges may be fully exempted from penalties, e.g. to guarantee access from a set of trusted management addresses, using the new sshd_config(5) PerSourcePenaltyExemptList option.
  
  source
  - loudwhisper@infosec.pub ⁨3⁩ ⁨months⁩ ago
    Nice! I didn’t know this. Thanks!
    
    source