3 ms·
Everyone should do key based auth anyway - so I don't even see use for fail2ban anymore in context of SSH.
by ozim 5y ago
Everyone should do key based auth anyway - so I don't even see use for fail2ban anymore in context of SSH.
- handrous 5y agoOn smallish servers it can keep the logs human-browsable without filtering. Not necessary, but nice.
- acatton 5y agospiped is not an exclusive or to key based auth. I advise to use spiped + key based authentication. spiped allows also for circumventing zero-day attacks on openssh.
- deleted 5y ago[deleted]
- UI_at_80x24 5y agoYes everyone should use key-based authentication. What fail2ban and other firewall styled security measures do is to move the point of contact on your network. 1 - You want to limit the number of times that SSHD initializes the connection handshake, this initialization period is when/where 0-day exploits can get through. 2 - With active auditing you can add the banned IP's to your edge device. Odds are that a legitimate IP won't be trying to SSH into your systems so block everything from them. I go one step further and share that banned IP list on all my edge devices.