3 ms·
I use iptables to ratelimit ssh connections to 4 per 300 seconds per ip. I feel like that plus using a key provides a reasonable level of security while not be
by x0x0 11y ago
I use iptables to ratelimit ssh connections to 4 per 300 seconds per ip. I feel like that plus using a key provides a reasonable level of security while not being a pita.
Open question -- is there any reason this is a bad idea?
- kazinator 11y agoThis is all connections, even if every connection attempt from a given IP succeeds? It's not a bad policy overall, but of course it interferes with a legitimate use: a script which rapidly executes numerous SSH commands.
- x0x0 11y agoyes, all connections things like scp and rsync recycle connections across files though, so it hasn't been a problem in practice; ansible does too if you use openssh instead of paramiko ps -- if someone knows iptables well, and is willing to share a similar script for failed connections, I would be grateful! But doing this across all ssh connections was easy enough that even I managed to get it working.
- kazinator 11y agoI'm talking about have a shell script like: while whatever ; do # hit host with a ssh command numerous times in loop ssh user@host command ... ... done Banning more than X failed connection attempts from an IP in Y minutes is done with utilities like fail2ban, which wheedle that information from system logs.