5 ms·
That seems like overkill. I just disable password authentication, and use SSH public keys only. It prevents brute force attacks completely.
by sltkr 3y ago
That seems like overkill. I just disable password authentication, and use SSH public keys only. It prevents brute force attacks completely.
- BrandoElFollito 3y agoThis, and move the endpoint on an uninteresting port to lower the noise in the logs
- KMag 3y ago... and avoid automated attacks in case a 0-day in the pre-authentication OpenSSH server code shows up
- hsbauauvhabzb 3y agoIf there’s a preauth RCE in ssh, I’m sure threat actors will start scanning non default ports once their hornets have hit critical mass.
- NoZebra120vClip 3y agoI suppose it may do that, but naïvely switching to an alternate port may lull one into a false sense of security: https://utcc.utoronto.ca/~cks/space/blog/sysadmin/SSHAltPortNoSecurity https://utcc.utoronto.ca/~cks/space/blog/sysadmin/SSHAltPort... Shodan will find and fingerprint you easily enough.
- michaelcampbell 3y agoIn theory. I have a server running on a weird port, but with fail2ban just in case. I haven't had even a blip of an attempt on it.
- ravi-delia 3y agoIt's not for security, it's public service and entertainment