3 ms·

> Implement firewalls This is the most important by faaaar. Do this experiment: Start a vm on any cloud with an open port 22, and watch the logs of sshd servi

> Implement firewalls This is the most important by faaaar. Do this experiment: Start a vm on any cloud with an open port 22, and watch the logs of sshd service. You will be amazed at the number of requests with bad credentials that will hit your machine within minutes. I watched logs to different ports, and ssh wins first place

mattrighetti 5y ago
Probably not as effective as firewalls but I use Fail2Ban to block some of those random requests IP on my local server exposed to the internet
JimDabell 5y ago
> You will be amazed at the number of requests with bad credentials that will hit your machine within minutes. Why are you worried about requests with bad credentials?
- fmajid 5y ago
  Not mikesabbagh, but depending on your sshd_config's MaxStartups you can easily be locked out of SSH access if the probers have too many active unauthenticated sessions holding up your own from connecting. Having a backup sshd behind something like Wireguard is an inexpensive insurance against this kind of DoS.
jjav 5y ago
You shouldn't be amazed. Assume that any available service will be probed continuously. There's no harm in that. Sure the log noise can be annoying but be in peace with it. If there are no weak credentials which can allow access, there's no issue. The "if" is important, but tractable.
- patrakov 5y ago
  There _is_ harm. At one of the places where I worked previously, we used a few dedicated servers in different cities, and periodically synchronized data from the central one to all others using rsync-over-ssh. Sometimes we got a warning from rsync that the connection was unexpectedly closed. We have traced this warning to SSH credential bruteforcers (yes, completely futile) that exhausted MaxStartups. So, we installed fail2ban.
  - BenjiWiebe 5y ago
    I've ran into this myself. I couldn't ssh into my server until I disconnected the router (home server, and I was in the LAN). Turns out it was an extreme case of ssh bruteforce attempts that maxed out connection count or maxstartups or something like that. Don't remember exactly which resource was the bottleneck.

mattrighetti 5y ago

Probably not as effective as firewalls but I use Fail2Ban to block some of those random requests IP on my local server exposed to the internet

JimDabell 5y ago

> You will be amazed at the number of requests with bad credentials that will hit your machine within minutes. Why are you worried about requests with bad credentials?

fmajid 5y ago
Not mikesabbagh, but depending on your sshd_config's MaxStartups you can easily be locked out of SSH access if the probers have too many active unauthenticated sessions holding up your own from connecting. Having a backup sshd behind something like Wireguard is an inexpensive insurance against this kind of DoS.

jjav 5y ago

You shouldn't be amazed. Assume that any available service will be probed continuously. There's no harm in that. Sure the log noise can be annoying but be in peace with it. If there are no weak credentials which can allow access, there's no issue. The "if" is important, but tractable.

patrakov 5y ago
There _is_ harm. At one of the places where I worked previously, we used a few dedicated servers in different cities, and periodically synchronized data from the central one to all others using rsync-over-ssh. Sometimes we got a warning from rsync that the connection was unexpectedly closed. We have traced this warning to SSH credential bruteforcers (yes, completely futile) that exhausted MaxStartups. So, we installed fail2ban.
- BenjiWiebe 5y ago
  I've ran into this myself. I couldn't ssh into my server until I disconnected the router (home server, and I was in the LAN). Turns out it was an extreme case of ssh bruteforce attempts that maxed out connection count or maxstartups or something like that. Don't remember exactly which resource was the bottleneck.