5 ms·
> Putting SSH on a nonstandard port is pretty silly. what's the alternative while still keeping ssh logs that aren't filled with thousands of login attempts fr
by leeoniya 8y ago
> Putting SSH on a nonstandard port is pretty silly.
what's the alternative while still keeping ssh logs that aren't filled with thousands of login attempts from bots per day? afaik there isnt any solution that is both as simple and as effective as changing the port.
- deathanatos 8y agofail2ban will cut down on log noise signficantly, while still allowing you to operate on the standard port. It also thwarts brute-force login attempts, if you're using password authentication. (Which you shouldn't, without good reason. Use public key authentication.)
- tyingq 8y agoI like pam_shield a bit better than fail2ban. It's directly tied to pam, versus trolling logs, so the configuration and operation is cleaner.
- ryanlol 8y agoNot sure if it’s sad or hilarious that people recommend fail2ban as a solution to log spam (or as a solution to anything really) Do you really think making firewalling decisions based on unstructured attacker-controlled log data is a good idea?
- romeisendcoming 8y agoYou control what fail2ban does with said log data and what actually gets logged. There are better ways than fail2ban of course but it's not the worst solution on the planet.
- ryanlol 8y agoIf you're using regex to parse attacker controlled files I'm not entirely sure if you're in control. Many unexpected things can happen, as a simple example SSH can generate log entries like this Jan 30 17:37:04 server sshd[26695]: Invalid user root from 127.0.0.1 from 10.0.0.1 The default rules can deal with this specific example, but this is certainly a path I wouldn't want to go down myself.
- viraptor 8y agoAccess behind VPN connection. Or deal with the logs in a better way. If SSH noise bothers you, you can either direct it to a different file, or setup a log aggregator where it's trivial to see what you want (or filter out what you don't by default)