4 ms·

Moving your SSH server away from port 22 and disabling password logins is also something you should consider doing. Small thing but at least then it doesn't sh

• api 13y ago
  Is it actually likely that someone would brute force a password? I always install fail2ban, but it's more just to stop bots from filling up my logs with junk and eating my bandwidth/CPU. Unless you use dumb passwords, the odds are phenomenally low.
  • mindcrime 13y ago
    I'm not sure, but I've come around to realize that it's always worth installing and configuring fail2ban just for the reasons you mentioned, if nothing else. I have a demo server that, for a while, was being hammered so hard by ssh brute-force bots that it kept getting knocked offline. I installed fail2ban and no more problems since. I personally can't recommend fail2ban highly enough.
    • MertsA 13y ago
      fail2ban is based on the horribly flawed premise of correctly parsing arbitrary text logs from tons of different programs that wrote their log format without any concerns about parsing that output later. Not surprisingly there have been numerous vulnerabilities in fail2ban that let an attacker ban arbitrary hosts such as your DNS server, database, etc. https://www.google.com/search?q=fail2ban+dos+bug https://www.google.com/search?q=fail2ban+dos+bug A better approach is something like pam_abl which is a pam module that will accomplish mostly the same thing but only for login attempts and without the crappy plain text log parsing.
    • flexd 13y ago
      Have you tried denyhosts? I've always been installing denyhosts but I have not compared the two.