3 ms·
Not disagreeing in general and disallowing password login for root is IMO really a no-brainer. But, it's nonetheless a fact that a (temporary) nft drop rule in
by tlamponi 4y ago
Not disagreeing in general and disallowing password login for root is IMO really a no-brainer.
But, it's nonetheless a fact that a (temporary) nft drop rule in the kernel is much more effective than traffic hitting a user space daemon like SSH.
Some NICs even allow offloading that (e.g., in form of a bpf program) to the card itself, so that such traffic won't ever hit the system (CPU) at all.
So yes, SSH can be made secure and rate-limited without anything else, but that won't be the most efficient solution; now fail2ban/sshguard/... ain't no free lunch either, so one needs to weight the added (IMO small, but still) complexity against benefits in a specific use case.