5 ms·
Such an amount of connections should anyway trigger all possible logging & IDS systems, right?
by ale42 2y ago
Such an amount of connections should anyway trigger all possible logging & IDS systems, right?
- megous 2y agoI doubt most servers use any such thing.
- stefan_ 2y agoIf you don’t value your time, sure? There’s thousands of systems trying to log into publicly accessible SSH servers all the time.
- XorNot 2y agoYeah slow bruteforces are running all over the net all the time. This means there's no reason not to throw this attack into the mix.
- Piskvorrr 2y agoIt should trigger fail2ban, that's for sure. Alerting is useless, with the volume of automated exploits attempted.
- TacticalCoder 2y ago> It should trigger fail2ban, that's for sure. But people here are going to explain that fail2ban is security theater...
- Piskvorrr 2y agoIt's a doorstop, not a fix. Useful nonetheless.
- DEADMINCE 2y agoCan you link to any comment in this thread of someone actually claiming that?
- BrandoElFollito 2y agoI am one of the people who see fail2ban as a nuisance for the average administrator. Average means that they know things on average and sooner or later fail2ban will block unexpectedly. Usually when you are away canoeing in the wilderness. This is all a matter of threat and risk management. If you know what you are doing then fail2ban or portknocking is another layer on your security. Security theater in my opinion is something else: nonsense password policies, hiding your SSID, whitelisting MACs, ...
- johnklos 2y agoIf you have a public facing Internet server, you're probably already running something like blocklistd or fail2ban. They reduce abuse, but they don't do anything to avoid an issue like this except from naive attackers. More resourceful attackers could automate attempted exploit using a huge botnet, and it'd likely look similar to the background of ssh brute force bots that we already see 24/7/365.