3 ms·
Hmm, there's noise, and there's noise. If you know that password auth is disabled, don't you just grep out all the disconnected/preauth and 'invalid user' line
by logifail 5y ago
Hmm, there's noise, and there's noise.
If you know that password auth is disabled, don't you just grep out all the disconnected/preauth and 'invalid user' lines before you even look at (or process) auth.log?
On a box where password auth is enabled, you can't be sure what's signal and what's noise.
- cube00 5y agoI guess I'm also worried about an SSH zero day hitting that I could avoid if I firewall filter the source IPs. I offer other services on the public internet so a zero day could hit them but I don't have a choice in those cases (eg. incoming mail on 25), however with SSH I don't need to offer it to the world so why take the risk in the first place?