4 ms·
If you disable password auth completely (you're using key auth... right???) most of the password bruteforcers will just go away.
by nullc 4y ago
If you disable password auth completely (you're using key auth... right???) most of the password bruteforcers will just go away.
- silisili 4y agoI just move it off port 22 first. That alone makes it go from hundreds of attempts per day to zero.
- mekster 4y agoI'd expect a (ex?) crypto developer to think security from another perspective, but what if the key is leaked? It's time another prevention system may save your day.
- perlgeek 4y agoIf your private SSH key is leaked, you can expect the attacker to come up in with a single successful login attempt, sshguard, fail2ban etc. won't help. The only help against that scenario is a true multi factor setup, or maybe a hardware-based security token that needs a second factor (fingerprint or PIN) to unlock.
- mekster 4y agoHow's that so? The attacker has no knowledge of the user name of the key, unless that is also leaked, then only white listed IP may help.
- nullc 4y agohope you don't use github (which discloses all users keys, attached to their usernames there), and/or the same username in multiple places. SSH also leaks the keys it'll accept, it doesn't use a zero knowledge proof to first determine if the client and the server have mutually acceptable keys.
- nullc 4y agoFWIW, you can make your SSH itself key-auth only and then setup whatever second factor you like via pam. (including fancy stuff if you like, n of m yubikeys ...)