4 ms·
Just use something like fail2ban to drop these at the packet filter level, either courtesy of your cloud provider or on the host itself. Make sure your sshd con
by nickdothutton 5y ago
Just use something like fail2ban to drop these at the packet filter level, either courtesy of your cloud provider or on the host itself. Make sure your sshd config is watertight.
- nousermane 5y agoAre there reputable places where people can share the IPs tripping fail2ban? Like spamhaus.org, but for scanners?
- cpach 5y agoHonest question: Why bother?
- loeg 5y agoYou know, or just don’t use fail2ban: https://research.securitum.com/fail2ban-remote-code-execution/ https://research.securitum.com/fail2ban-remote-code-executio... . It’s adding extra attack surface for a cosmetic benefit.
- tempodox 5y agoGood catch, thanks! Remedy: Don't let fail2ban send mail, or at least remove the whois part.
- megous 5y agonftables allows to automatize blocking of IP addresses (even with a automatic timeout) without any userspace involvement. Pretty nifty feature.