4 ms·

Similar tool: fail2ban: https://www.fail2ban.org/wiki/index.php/Main_Page https://www.fail2ban.org/wiki/index.php/Main_Page Tools like these are essential if

Similar tool: fail2ban: https://www.fail2ban.org/wiki/index.php/Main_Page https://www.fail2ban.org/wiki/index.php/Main_Page Tools like these are essential if you have Internet-facing SSH services. If you do not need Internet-facing SSH, do not enable it. It can be an attack vector and there are hundreds of bots that will try to brute-force access within minutes of opening Internet-facing SSH daemon. Best practices for Internet-facing SSH: - run on non-standard port (not port 22) - disable passwords, use SSH passkeys instead: https://www.techrepublic.com/article/how-to-setup-ssh-key-authentication/ https://www.techrepublic.com/article/how-to-setup-ssh-key-au... - disable root SSH login - run fail2ban, sshguard, or similar "block IP addresses for suspicious activity" services - setup port knocking: https://www.tecmint.com/port-knocking-to-secure-ssh/ https://www.tecmint.com/port-knocking-to-secure-ssh/ edit: - run WireGuard VPN (https://en.wikipedia.org/wiki/WireGuard https://en.wikipedia.org/wiki/WireGuard) for defense-in-depth

deleted 4y ago
[deleted]
deleted 4y ago
[deleted]
jamal-kumar 4y ago
The issue with fail2ban is that it's an extremely heavy python application. It takes up a boatload of resources! SSHGuard however is much lighter and even less to configure manually.
- thesuperbigfrog 4y ago
  I am not trying to compare fail2ban and SSHGuard. I used fail2ban in the past and it was helpful. If I was currently running an Internet-facing SSH daemon, I would give SSHGuard a try.
- seized 4y ago
  From quickly skimming the docs, Fail2Ban can do a few other things like execute a script for the action. I have it doing an API call to block the offending IP on OPNSense firewall.
qbasic_forever 4y ago
Or just run wireguard and ssh on top of that without all the fussy config and tooling to expose ssh to the internet. You could even live dangerously and just use telnet once you have wireguard going.
- GekkePrutser 4y ago
  I use ssh as a fallback for when my VPN fails to activate somehow.
  - funstuff007 4y ago
    True, true, true. You cannot rely on the VPN always working.
- thesuperbigfrog 4y ago
  >> Or just run wireguard and ssh on top of that without all the fussy config and tooling to expose ssh to the internet. Nice! Wireguard was not around when I was using Internet-facing SSH in a previous job. Adding it to the recommendations.
  - smackeyacky 4y ago
    Tailscale is a good solution. I have no ports open on my internet facing router at all any more. Tailscale has proved to be as reliable as the servers themselves. I like it so much I use it to access my AWS machines as well, by running it as an exit node up there.
- remram 4y ago
  Is Wireguard more secure than SSH?
  - fmajid 4y ago
    It's not TCP based so you can't port scan it like SSH, and it will only respond on successful authentication, so a failed attempt is undistinguishable from it not being there. It is also fairly easy to DoS SSH by having too many connections in the authentication state leaving no slots open, which SSHGuard is useful to counter. Apart from that, SSH's intrinsic security is the same, but if you have password authentication enabled, you are only as strong as the weakest password.
bobleeswagger 4y ago
Crowdsec seems to be the modern Fail2Ban replacement, it works quite well and has led to some useful insights.
justusthane 4y ago
This is advice from the 90s and is mostly security through obscurity, except for the last one. Modern advice: don’t use password auth.
- mekster 4y ago
  Dismissing security through obscurity as pointless is an advice from the 90s. Basically security comes with layers of obscurity. Even key based auth is a random string that no one is meant to guess. If you have more obscurity, the less chance one reaches to the actual attack surface. If an attacker gains a key, without fail2ban etc, he may try bunch of user names against the key file consecutively but if a login attempt is limited to 3 times every 5 minutes, see it's better than nothing.

deleted 4y ago

[deleted]

deleted 4y ago

[deleted]

jamal-kumar 4y ago

The issue with fail2ban is that it's an extremely heavy python application. It takes up a boatload of resources! SSHGuard however is much lighter and even less to configure manually.

thesuperbigfrog 4y ago
I am not trying to compare fail2ban and SSHGuard. I used fail2ban in the past and it was helpful. If I was currently running an Internet-facing SSH daemon, I would give SSHGuard a try.
seized 4y ago
From quickly skimming the docs, Fail2Ban can do a few other things like execute a script for the action. I have it doing an API call to block the offending IP on OPNSense firewall.

qbasic_forever 4y ago

Or just run wireguard and ssh on top of that without all the fussy config and tooling to expose ssh to the internet. You could even live dangerously and just use telnet once you have wireguard going.

GekkePrutser 4y ago
I use ssh as a fallback for when my VPN fails to activate somehow.
- funstuff007 4y ago
  True, true, true. You cannot rely on the VPN always working.
thesuperbigfrog 4y ago
>> Or just run wireguard and ssh on top of that without all the fussy config and tooling to expose ssh to the internet. Nice! Wireguard was not around when I was using Internet-facing SSH in a previous job. Adding it to the recommendations.
- smackeyacky 4y ago
  Tailscale is a good solution. I have no ports open on my internet facing router at all any more. Tailscale has proved to be as reliable as the servers themselves. I like it so much I use it to access my AWS machines as well, by running it as an exit node up there.
remram 4y ago
Is Wireguard more secure than SSH?
- fmajid 4y ago
  It's not TCP based so you can't port scan it like SSH, and it will only respond on successful authentication, so a failed attempt is undistinguishable from it not being there. It is also fairly easy to DoS SSH by having too many connections in the authentication state leaving no slots open, which SSHGuard is useful to counter. Apart from that, SSH's intrinsic security is the same, but if you have password authentication enabled, you are only as strong as the weakest password.

bobleeswagger 4y ago

Crowdsec seems to be the modern Fail2Ban replacement, it works quite well and has led to some useful insights.

justusthane 4y ago

This is advice from the 90s and is mostly security through obscurity, except for the last one. Modern advice: don’t use password auth.

mekster 4y ago
Dismissing security through obscurity as pointless is an advice from the 90s. Basically security comes with layers of obscurity. Even key based auth is a random string that no one is meant to guess. If you have more obscurity, the less chance one reaches to the actual attack surface. If an attacker gains a key, without fail2ban etc, he may try bunch of user names against the key file consecutively but if a login attempt is limited to 3 times every 5 minutes, see it's better than nothing.