3 ms·

It's weird that even right-thinking engineers will vehemently argue against just being a lemming on any number of issues, but all it takes is a few "move SSH po

It's weird that even right-thinking engineers will vehemently argue against just being a lemming on any number of issues, but all it takes is a few "move SSH port to clean up your logs and install fail2ban" guides and here we are. This really hits people who dabble in operations with a personal server or something. It's probably a failure of operations folks like me to properly reach developers and other groups who simply toy with our dark arts in the pursuit of getting something done. Operating on the Internet is capital H Hazardous, and simply buying a guide wholesale without understanding it even more so. I am identifying a need.

teddyh 10y ago
The problem is that people get unnerved by the log entries showing unsuccessful logins. They get a knee-jerk reaction and the first thing they think of (which will work) is to change the SSH port. What should have stopped them is the feeling that they are now disobeying the internet standards, and the standardized ports are probably standardized for a reason. It’s the same reason anyone should feel a mental pain when considering any quick-and-dirty method of fixing a problem – it is dirty, and will have repercussions. (The same phenomenon, knee-jerk reactions, could be seen starting in the mid-90s when everybody and their dog had a Solution™ to the e-mail spam problem, leading to canned rebuttals like this: http://craphound.com/spamsolutions.txt http://craphound.com/spamsolutions.txt) The proper solution for SSH is probably for the OpenSSH authors to change OpenSSH to no longer log unsuccessful logins (at least by default). If there’s a successful login, the log entry might add how many previous unsuccesful logins there had been within the previous few minutes, but I see no reason at all to log unsuccessful login attempts anymore. The current logging defaults were normal for its time when the code was written, when the internet was very different, but today they are simply scaring people for no reason.

teddyh 10y ago

The problem is that people get unnerved by the log entries showing unsuccessful logins. They get a knee-jerk reaction and the first thing they think of (which will work) is to change the SSH port. What should have stopped them is the feeling that they are now disobeying the internet standards, and the standardized ports are probably standardized for a reason. It’s the same reason anyone should feel a mental pain when considering any quick-and-dirty method of fixing a problem – it is dirty, and will have repercussions. (The same phenomenon, knee-jerk reactions, could be seen starting in the mid-90s when everybody and their dog had a Solution™ to the e-mail spam problem, leading to canned rebuttals like this: http://craphound.com/spamsolutions.txt http://craphound.com/spamsolutions.txt) The proper solution for SSH is probably for the OpenSSH authors to change OpenSSH to no longer log unsuccessful logins (at least by default). If there’s a successful login, the log entry might add how many previous unsuccesful logins there had been within the previous few minutes, but I see no reason at all to log unsuccessful login attempts anymore. The current logging defaults were normal for its time when the code was written, when the internet was very different, but today they are simply scaring people for no reason.