7 ms·
It would most probably never end up pegging an entire core if you use key auth and have conventional logins deactivated, no? I mean, why would people even try.
by hh3k0 8y ago
It would most probably never end up pegging an entire core if you use key auth and have conventional logins deactivated, no?
I mean, why would people even try.
- sophacles 8y agoKeys, like passwords, can be leaked, so it's possible there are databases of leaked keys out in the world, because unlike PGP or SSL certs, ssh keys don't have a revocation mechanism built in. So they could just try all the known leaked keys - like they try known leaked or default passwords. Then there was this: https://jblevins.org/log/ssh-vulnkey https://jblevins.org/log/ssh-vulnkey (tl;dr - there was a bug in debian that caused ssh-keygen to only produce a very small number of keys rather than keys distributed across the whole keyspace). After that became public the bots were all about trying those keys for a few years after. To this day it's recommended to not used keys from that set. Point being - the bots will try because it the tiny marginal cost is not high enough to stop the attempt.
- kuschku 8y agoThey simply try password auth, and fail with a message that password auth is off. Constantly. All the time.
- purple-again 8y agoSet up a non standard port. This will stop over night.