3 ms·

I use fail2ban as well. I honestly don't get why people get so worked up about SSH. As long as you have a long, secure password, how is it a security vulnerabi

• jacquesm 14y ago
  Because if there is an exploit that allows an attacker to recover your password for instance from a session replay then you're instantly open.
  • ChuckMcM 14y ago
    So split the conversation, there are little threats and big threats. I don't have 6 locks on a steel door at my house, the big threats are going to break the picture window and walk in that way. So if you're running one of the 100s of millions of non-descript servers out there then fail2ban and putting ssh on a non-standard port will keep the opportunists out of your server (at least via ssh). If they are using a zero day against you, or are waiting to capture traffic to do a plaintext attack they aren't opportunists, they are gunning for you. That is a different threat model.
    • jacquesm 14y ago
      Unfortunately I have to deal with both, but you're 100% right, those are definitely different categories.
• cbs 14y ago
  Looking at it from a defense-in-depth perspective, its another layer of protection. Even if you use fail2ban and mandate key-based logins, it answers questions like "what if there is a 0day for my sshd?" Its not a bad idea, it just happens that careful sshd practices are good enough that more layers are subject to highly diminished returns.