3 ms·
Avoiding something like this because the possibility exists that someone will do something else wrong is just silly. Also, the amount of CPU taken by brute for
by johnklos 5y ago
Avoiding something like this because the possibility exists that someone will do something else wrong is just silly.
Also, the amount of CPU taken by brute force ssh is not zero. There are plenty of good reasons for this. Even if this by itself isn't the best implementation, it's an example of how to make things much, much harder on attackers.
- walrus01 5y agoThe amount of CPU taken by brute force SSH on any modern system is negligible - unless we're talking about traffic levels that would qualify as a DDoS. Maybe 0.02 points on a standard unix load scale. In any case you should have something like fail2ban or its equivalent that blackholes traffic from repeated failed attempts to authenticate, not just to your public facing ssh daemon, but lots of other things. The default debian fail2ban daemon configurations, easily toggled on or off to watch various log files, are quite sensible.
- WesolyKubeczek 5y agoThe bandwidth ain’t growin’ on dem trees, son, and the likes of AWS are selling it to you for some pretty penny.