6 ms·

If you use fail2ban make sure to pin the right key to the right host. Otherwise ssh will try all the keys and get you banned from your own host. The easiest way

• chmike 10y ago
  Good advise. This happenned to me. By luck I had another account I could use to recover. I wish I could disable that feature. I use config now but the default should not be to try every key in ssh directory.
  • kardos 10y ago
    Agreed. That seems like a weakness in OpenSSH. One should have to turn on a "try all keys" option to get that behaviour ..
    • jlgaddis 10y ago
      Yeah, it's on by default. See IdentitiesOnly to turn it off.
• sneak 10y ago
  If you're using key based auth exclusively, you don't need fail2ban.
  • fail2fail2ban 10y ago
    fail2ban is for any log you want to monitor and block access to your machine for; not just ssh. fail2ban isn't a "keep my logs clean" tool it's a "reduce my attack surface" tool. Edit: Feel free to Google "fail2ban security" if you disagree.
• loeg 10y ago
  Also, low values of the sshd option "MaxAuthTries" makes having multiple keys annoying. There are servers I have to log into with "1" or "2". It's really annoying and doesn't enhance security, especially with "PasswordAuthentication no".
• Tharkun 10y ago
  You should do this even if you're not using fail2ban. Otherwise any box you connect to can enumerate all of your public keys, which could be a problem for some people.
  • zwily 10y ago
    I don't think doing this actually prevents that. Your full agent is still forwarded. You need to use a separate agent per key if you want to prevent the remote host from using your other keys.
• sseagull 10y ago
  It still may try other identity files. You need the IdentitiesOnly option, I believe. I've been bitten by this a few times.