3 ms·
Anyone who has run an SSH server on the default port knows that you’ll get hundreds or thousands of login attempts per day. Changing the port to something less
by IAmGraydon 3y ago
Anyone who has run an SSH server on the default port knows that you’ll get hundreds or thousands of login attempts per day. Changing the port to something less obvious and running fail2ban is enough to mitigate most of it. They’re just looking for low hanging fruit.
- PhilipRoman 3y agoChanging the default port - yeah, works wonders for reducing noise. But I don't understand why people run fail2ban. Nobody is going to be brute forcing a ssh login, all it does is add another moving part very close to a security boundary for very little gain.
- gnabgib 3y agoHave you recently run a server? It takes a week-month before your ssh port is published on shodan/binaryedge/censys/criminalIP and other dodgy scanners.. and then you can expect constant attention, and yes.. 14691 attempted logins for every username possible (even though password login is turned off) from the same IP (usually a VPN, tor exit, or "crowdsourced VPN")
- tetris11 3y agoYes they do. I had a colleague who opened up his machine to another using the logon "remote" and let them set the password. It was cracked the next day. It turns out having 12345678 is probably a bad password.
- KomoD 3y ago> Nobody is going to be brute forcing a ssh login Uh what? Yes people do...
- chx 3y agoI just run sslh...