6 ms·
That sounds like a much better solution than I've used in the past. By simply restricting total # of connections / IP to one my attacks dropped dramatically, b
by perpetualcrayon 9y ago
That sounds like a much better solution than I've used in the past. By simply restricting total # of connections / IP to one my attacks dropped dramatically, but not gone completely.
I think it's just a matter of numbers. The IP search space is already pretty large with IPv4 on just a single port. With IPv6 it'll be more or less impossible for attackers to make any substantial progress by just searching for IP addresses to attack, let alone an IPv6 address on a non-standard port.
After reading this I'm likely going to be upgrading my technique. SSH on IPv6 only (eventually shutting down IPv4 altogether, can't wait), listening on a non-standard port, limit 1 connection per IP.
- throwaway613834 9y agoYeah, definitely listen on a nonstandard port. I'm not sure how to limit to 1 connection per IP but it sounds rather limiting, so I wouldn't do it... I often have multiple SSH sessions from my own IP.
- perpetualcrayon 9y agoI just run a 'screen' session to open 10 bash sessions simultaneously when I want to do anything substantial. That has never felt restrictive to me.
- throwaway613834 9y agoCan you see two screens simultaneously with screen though?
- perpetualcrayon 9y agoI'm not sure. The need has never come up for me though.
- blfr 9y agoIf you want this, I would suggest tmux. Tmux by default comes with tabs (multiple terminals) and panes (multiple terminals visible at once within a tab) where you can split your screen vertically and horizontally however you like. Usually, you want one full-height terminal and two about half the height of your screen. http://www.kaltpost.de/wp-content/uploads/2013/02/tmux.png http://www.kaltpost.de/wp-content/uploads/2013/02/tmux.png
- throwaway613834 9y agoBut these are so much more restrictive. Right now I just open two terminal windows -- they can overlap each other, I can make it so one covers every part of the other except a tiny part whose update I want to see, and make changes in these first one. I can kill programs in one without being worried about accidentally killing them in the other. I just don't see the appeal of forcing everything into a single terminal screen honestly. What's the benefit?
- merijnv 9y agoIf your network connection drops long running jobs keep running, no setup. I do most of my work on our university cluster over SSH. I can close/shutdown my laptop at any time (or have my connection drop) and as soon as I SSH back into the server all my editors, shells, running jobs, etc. are exactly how I left them.
- throwaway613834 9y agoOh, that's not quite what I meant. The question wasn't about whether I should use {screen,tmux} to open a shell; the question was whether I should use {tmux,etc.} to manage multiple shells in the same terminal window. As opposed to having multiple instances of them open in different windows.
- eru 9y agoMosh is also worth a look.
- firethief 9y ago
- eru 9y agoYou can also share an ssh connection between sessions.
- blfr 9y agoGive yourself some breathing room. I limit connections to four in a three minute window. iptables -A INPUT -p tcp -m tcp --dport 22 -m recent --update --seconds 180 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j DROP