6 ms·

I usually just disable password auth and update regularly, when I have an SSH server open to the internet. Short of an 0day in the SSH service, I expect brute

I usually just disable password auth and update regularly, when I have an SSH server open to the internet. Short of an 0day in the SSH service, I expect brute forcing the private key(s) to take longer than I have years to live.

oceanghost 6y ago
There are bots out there that will attack from thousands if not 10's of thousands of IPs... It's impossible to ban the individual IPs byh hand, so I let them tell me who they are by leaving the SSH port open and have fail2ban ban any IP that fails to authenticate for a month. This had an unintended effect... most of my automated HTTP(s) attacks stopped as well-- presumably because the IPs of compromised machines were already blocked.
- Libbum 6y ago
  That's interesting! Care to share your fail2ban config for this?
  - avian 6y ago
    Sounds like just a vanilla sshd filter with bantime cranked up to 1 month instead of the default (and possibly maxretry=1 or something low like that)
tambourine_man 6y ago
But it takes CPU, fills up log files, etc. fail2ban is the first thing install. It’s also easy to understand, which I love. It’s basically regex on log files.
- necheffa 6y ago
  It really doesn't make that big a difference. I have single core, 515MiB VMs that idle at <1% utilization with background noise. Most distros come with logrotate anyways.
  - drdaeman 6y ago
    > Most distros Most distros those days come with journald, and to best of my awareness journald does not have per-unit (or better, per unit per message type) configurable retention. Still in the TODO list today: https://github.com/systemd/systemd/blob/908dbc70d6abeb9f65624d89fb5ca021815d69ae/TODO#L1037 https://github.com/systemd/systemd/blob/908dbc70d6abeb9f6562... (since at least 2016), with corresponding issue gathering no traction: https://github.com/systemd/systemd/issues/9519 https://github.com/systemd/systemd/issues/9519
    - deleted 6y ago
      [deleted]
    - jlgaddis 6y ago
      Yes, but don't most of them also come with syslog forwarding enabled and a syslogd (rsyslog, syslog-ng, etc.) and logrotate installed?
- RL_Quine 6y ago
  What decade are your servers from? A failed key authentication doesn't even involve any cryptographic operation unless they also know the hash of your public key.
  - tambourine_man 6y ago
    Raspberry Pi. It was taking considerable CPU with many attempts per second.
- gramakri 6y ago
  There is no cpu use. The hash compare of key will fail if I understand correctly.

oceanghost 6y ago

There are bots out there that will attack from thousands if not 10's of thousands of IPs... It's impossible to ban the individual IPs byh hand, so I let them tell me who they are by leaving the SSH port open and have fail2ban ban any IP that fails to authenticate for a month. This had an unintended effect... most of my automated HTTP(s) attacks stopped as well-- presumably because the IPs of compromised machines were already blocked.

Libbum 6y ago
That's interesting! Care to share your fail2ban config for this?
- avian 6y ago
  Sounds like just a vanilla sshd filter with bantime cranked up to 1 month instead of the default (and possibly maxretry=1 or something low like that)

tambourine_man 6y ago

But it takes CPU, fills up log files, etc. fail2ban is the first thing install. It’s also easy to understand, which I love. It’s basically regex on log files.

necheffa 6y ago
It really doesn't make that big a difference. I have single core, 515MiB VMs that idle at <1% utilization with background noise. Most distros come with logrotate anyways.
- drdaeman 6y ago
  > Most distros Most distros those days come with journald, and to best of my awareness journald does not have per-unit (or better, per unit per message type) configurable retention. Still in the TODO list today: https://github.com/systemd/systemd/blob/908dbc70d6abeb9f65624d89fb5ca021815d69ae/TODO#L1037 https://github.com/systemd/systemd/blob/908dbc70d6abeb9f6562... (since at least 2016), with corresponding issue gathering no traction: https://github.com/systemd/systemd/issues/9519 https://github.com/systemd/systemd/issues/9519
  - deleted 6y ago
    [deleted]
  - jlgaddis 6y ago
    Yes, but don't most of them also come with syslog forwarding enabled and a syslogd (rsyslog, syslog-ng, etc.) and logrotate installed?
RL_Quine 6y ago
What decade are your servers from? A failed key authentication doesn't even involve any cryptographic operation unless they also know the hash of your public key.
- tambourine_man 6y ago
  Raspberry Pi. It was taking considerable CPU with many attempts per second.
gramakri 6y ago
There is no cpu use. The hash compare of key will fail if I understand correctly.