2 ms·
The iptables methods all have the flaw that multiple sequential short-lived successful connections will trigger a ban too. Limiting Internet-facing SSH connect
by josephcsible 4y ago
The iptables methods all have the flaw that multiple sequential short-lived successful connections will trigger a ban too.
Limiting Internet-facing SSH connections to key-only is definitely a good idea, though.
- cillian64 4y agoI experienced this at a previous company. Yocto/bitbake wanted to do a lot of git clones over SSH very quickly, but a firewall interpreted this as a brute force because it couldn’t tell that each SSH connection was actually successfully authenticating.
- 5e92cb50239222b 4y agoYou can enable SSH connection persistence by adding this to ~/.ssh/config: ServerAliveInterval 60 ControlMaster auto ControlPath ~/.ssh/conn/%r@%h:%p ControlPersist 1h I use it to speed up new SSH connections after the first one is made, but it should also prevent the issue you've described.