5 ms·
When I ran OpenBSD I used to block on repeated failed attempts(see: http://home.nuug.no/~peter/pf/en/long-firewall.html#BRUTEFORCE http://home.nuug.no/~peter/pf
by samuel 16y ago
When I ran OpenBSD I used to block on repeated failed attempts(see: http://home.nuug.no/~peter/pf/en/long-firewall.html#BRUTEFORCE http://home.nuug.no/~peter/pf/en/long-firewall.html#BRUTEFOR...).
I used to change ssh's port, but not anymore. If a bruteforce attack is a threat to you, then you are better being compromised by a random script kiddie or spammer than by a targeted attacker looking after your data. Take that scans as free, low skilled, penetration tests.
- wwortiz 16y agoA nonstandard port removes a crazy amount of login attempts though for something as simple as adding: Host example.com Port ##### to your ~/.ssh/config
- nuclear_eclipse 16y agoAlternately, adding those lines to every single host you control is one hell of an annoyance for something that doesn't stop any sort of real attack on your server. It's trivial for a real attacker to find your sshd running on any port.
- wwortiz 16y agoWell sure it could be bad if you are using 10 computers or you have 10 different servers to login to, but personally I have 2 computers that I use and only manage a few servers so it isn't all that bad, plus the config file is linked to dropbox for me. Besides it is more like a one time annoyance unless you are one of those crazy people that formats without backups every month.
- schammy 16y agoYes, this is true - it's not going to stop someone who really wants in from finding your SSH port. But at the very least, it's useful when looking through your logs, because the ONLY failed log in attempts you will see are from people who mean business.