3 ms·
#2 and #3 in your list are rather sweeping (fail2ban does more than protect ssh). I'm no expert either, the only thing I'd add is to disable password-based logi
by latch 12y ago
#2 and #3 in your list are rather sweeping (fail2ban does more than protect ssh). I'm no expert either, the only thing I'd add is to disable password-based logins and root-login [1]
[1] http://www.unixlore.net/articles/five-minutes-to-more-secure-ssh.html http://www.unixlore.net/articles/five-minutes-to-more-secure...
- yeukhon 12y agoI personally have a mixed feeling about disabling password-based login. What if you've lot your key and you need to access the server for reasons such as getting the data out, how do you do it without root and without login password? Is there a way to go around this issue? Let me know if there is because right now, I have login password that I don't re-use. Well, I guess for real deployment, serving real users, you'd have shading and a good central logging system so losing an instance is not a big deal, but for me I run a personal server and this is so far the way I protect myself (have login and ssh) in the case of lossing my key :( Anyhow, DO droplets allow people to "reset" root password and it is important to protect your DO account.