3 ms·
I use fail2ban on a server that is listening on a non-standard port. I monitor the bans on a daily basis. The IPs come from all over the world but when China s
by jakedata 5y ago
I use fail2ban on a server that is listening on a non-standard port.
I monitor the bans on a daily basis. The IPs come from all over the world but when China shut down from Covid the login attempts just _stopped_. Like, the silence was deafening, like I thought the server was compromised and logging disabled.
It was spooky as hell, but as things came back to something resembling normal, the background radiation started picking up again and I am back to 60-80 bans per day. I have a hell of a list of compromised IPs now.
- alyandon 5y agoI do something similar with firehol lists and iptables/ipfw scripts and it cut my auth log spam down to almost nothing - single digit auth attempts per day per server now usually. My first pass of blocking .cn network space on its own cut my log spam by probably 90% (thousands of attempts per day down to dozens).