4 ms·
> causing very large iptables leading high memory use > I know the usual advice then is to reduce ban time and just not have permabanning, but that seems to ki
by KennyBlanken 2y ago
> causing very large iptables leading high memory use
> I know the usual advice then is to reduce ban time and just not have permabanning, but that seems to kind of defeat the purpose.
The purpose is to make random password attempts even more impractical. With even fairly lax fail2ban rules, it'll take multiple lifetimes to find a password made up of just two common use english words.
However, that's not really their goal. I think that these SSH probes are mostly intended to find systems that have been compromised and have common backdoor passwords, though. ...and they use networks of zombie machines to do it.
That's where stuff like Crowdsec and IP ban lists come in, with the side benefit of your IP addresses becoming less 'visible'
- tomxor 2y ago>> I know the usual advice then is to reduce ban time and just not have permabanning, but that seems to kind of defeat the purpose. > The purpose is to make random password attempts even more impractical. With even fairly lax fail2ban rules, it'll take multiple lifetimes to find a password made up of just two common use english words. True, but the other reason to use such a measure is layered security. For instance I systematically disable all password only access, which kind of makes fail2ban seem a little pointless, but if there were to be some obscure bug in PAM, or SSH, or more likely a misconfiguration, then there is another layer that makes it more difficult.