3 ms·
It's still noise in the log you can do without if you really want to know what's going on with your system. For me I firewall ssh to only accept from known IPs.
by cube00 5y ago
It's still noise in the log you can do without if you really want to know what's going on with your system. For me I firewall ssh to only accept from known IPs. Worst case if I have to expand that list I'll login via the VPS provider's console to do that.
- logifail 5y agoHmm, there's noise, and there's noise. If you know that password auth is disabled, don't you just grep out all the disconnected/preauth and 'invalid user' lines before you even look at (or process) auth.log? On a box where password auth is enabled, you can't be sure what's signal and what's noise.
- cube00 5y agoI guess I'm also worried about an SSH zero day hitting that I could avoid if I firewall filter the source IPs. I offer other services on the public internet so a zero day could hit them but I don't have a choice in those cases (eg. incoming mail on 25), however with SSH I don't need to offer it to the world so why take the risk in the first place?