3 ms·
If your ISP and the server support IPv6, just disable SSH on IPv4. Some of my servers don't even have any IPv4 connectivity and there haven't been any failed S
by miyuru 5y ago
If your ISP and the server support IPv6, just disable SSH on IPv4.
Some of my servers don't even have any IPv4 connectivity and there haven't been any failed SSH logins over IPv6.
- jimsi 5y agoMy OpenSSH is located on a non standard port, 22/tcp is going to the endlessh honeypot.
- zinekeller 5y agoNot to disappoint you, but except for logging SSH honeypots are becoming useless (most bots automatically disconnect when they detect a long login banner).
- sudobash1 5y agoSo should I add a long banner to my server to disguise it as a honey pot, just in case?
- zinekeller 5y agoI mean, I'm not sure that you can do that with OpenSSH though (short of recompiling it, which I do not recommend unless you're a company).
- throw0101a 5y ago> endlessh honeypot. *tarpit A honeypot lets people "in" to see/research malware that's in the wild: * https://en.wikipedia.org/wiki/Honeypot_(computing) https://en.wikipedia.org/wiki/Honeypot_(computing) A tarpit just takes up the attacker's resources: * https://en.wikipedia.org/wiki/Tarpit_(networking) https://en.wikipedia.org/wiki/Tarpit_(networking)
- judge2020 5y agoNot what most people run, but SSH honeypots are also useful: https://lwn.net/Articles/848291/ https://lwn.net/Articles/848291/
- jagger27 5y agoI like this solution a lot!