5 ms·

Don't forget fail2ban or something similar. 2 hour lockout after 4 bad tries does wonders to discourage bots.

by pnutjam 6y ago

protomyth 6y ago
Well, if you use certificates, you can immediately ban anyone trying to do password authentication.
- dawnerd 6y ago
  Just an obvious protip to test that your cert works before banning password auths. I uh, found out the hard way.
  - protomyth 6y ago
    Yeah, cannot say I've never done that. Test then Ban.
  - efreak 6y ago
    I never had an issue with authentication. My issue was a typo in sudoers (I allowed a user to view syslog, iirc, and had a semicolon instead of a colon) that prevented me from using sudo, as only my primary user was allowed to log in via ssh. Fortunately cloud vps still has vnc login, and I actually had a root password. Now I use a root shell to edit sudoers, so I can test it before dropping root.
    - Symbiote 6y ago
      You should use "visudo", which opens the file in the default editor, then validates it before saving.
      - pnutjam 6y ago
        if you edit outside of visudo, you can run visudo -cf <filename>. example: visudo -cf /etc/sudoers visudoe -cf /etc/sudoers.d/extra
      - pbhjpbhj 6y ago
        But make sure to change the default editor to something sane first. (* ducks *) :q!dammitwtf
        bigbizisverywyz 6y ago
        +1 to that! I like nano, and I'm not ashamed to admit it.
- pnutjam 6y ago
  True, but having supported an sftp server for other b2b clients to upload data, ssh keys are black magic to too many people. I can't count the hours I've spent trying to explain them, how to generate them and why you should never "show anyone your privates", just your publics.
  - jooize 6y ago
    It would be more obvious if the private key files were named “id_ed25519.private”. Why not make it “identity.ed25519.private.sshkey” and default to “20200916{,T224400Z}.ed25519.{private,public}.sshkey”?
    - pnutjam 6y ago
      Put in a feature request to the openssh guys. Theo can probably tell you why it's not a good idea, or why it is good idea.
boring_twenties 6y ago
I don't like it because it opens up the possibility of someone on the same network as me locking me out of my own server. Sure, it's unlikely, but I don't see what I'd be gaining using fail2ban in the first place. I don't leave password authentication enabled, of course. Log spam is a bit annoying, but at the end of the day, who cares? Even with the ongoing attempts, my authlog is like 300K uncompressed today and 60-120K per day gzipped. Whatever. If I cared about that I would prefer to just block Chinese IP ranges outright.
- pnutjam 6y ago
  If your passing through a NAT, you can whitelist your own IP. something like: fail2ban-client set addignoreip x.x.x.x or fail2ban-client set addignoreregex hostname.com
  - boring_twenties 6y ago
    Sure. But why? We're talking about 1MB to keep a week's worth of logs. It's just not worth even a minor hassle, or the most remote possibility of failure.
    - pnutjam 6y ago
      It's not about logs, it's about defense layers.

Don't forget fail2ban or something similar. 2 hour lockout after 4 bad tries does wonders to discourage bots.

protomyth 6y ago

Well, if you use certificates, you can immediately ban anyone trying to do password authentication.

dawnerd 6y ago
Just an obvious protip to test that your cert works before banning password auths. I uh, found out the hard way.
- protomyth 6y ago
  Yeah, cannot say I've never done that. Test then Ban.
- efreak 6y ago
  I never had an issue with authentication. My issue was a typo in sudoers (I allowed a user to view syslog, iirc, and had a semicolon instead of a colon) that prevented me from using sudo, as only my primary user was allowed to log in via ssh. Fortunately cloud vps still has vnc login, and I actually had a root password. Now I use a root shell to edit sudoers, so I can test it before dropping root.
  - Symbiote 6y ago
    You should use "visudo", which opens the file in the default editor, then validates it before saving.
    - pnutjam 6y ago
      if you edit outside of visudo, you can run visudo -cf <filename>. example: visudo -cf /etc/sudoers visudoe -cf /etc/sudoers.d/extra
    - pbhjpbhj 6y ago
      But make sure to change the default editor to something sane first. (* ducks *) :q!dammitwtf
      - bigbizisverywyz 6y ago
        +1 to that! I like nano, and I'm not ashamed to admit it.
pnutjam 6y ago
True, but having supported an sftp server for other b2b clients to upload data, ssh keys are black magic to too many people. I can't count the hours I've spent trying to explain them, how to generate them and why you should never "show anyone your privates", just your publics.
- jooize 6y ago
  It would be more obvious if the private key files were named “id_ed25519.private”. Why not make it “identity.ed25519.private.sshkey” and default to “20200916{,T224400Z}.ed25519.{private,public}.sshkey”?
  - pnutjam 6y ago
    Put in a feature request to the openssh guys. Theo can probably tell you why it's not a good idea, or why it is good idea.

boring_twenties 6y ago

I don't like it because it opens up the possibility of someone on the same network as me locking me out of my own server. Sure, it's unlikely, but I don't see what I'd be gaining using fail2ban in the first place. I don't leave password authentication enabled, of course. Log spam is a bit annoying, but at the end of the day, who cares? Even with the ongoing attempts, my authlog is like 300K uncompressed today and 60-120K per day gzipped. Whatever. If I cared about that I would prefer to just block Chinese IP ranges outright.

pnutjam 6y ago
If your passing through a NAT, you can whitelist your own IP. something like: fail2ban-client set addignoreip x.x.x.x or fail2ban-client set addignoreregex hostname.com
- boring_twenties 6y ago
  Sure. But why? We're talking about 1MB to keep a week's worth of logs. It's just not worth even a minor hassle, or the most remote possibility of failure.
  - pnutjam 6y ago
    It's not about logs, it's about defense layers.