What SSH Hacking Attempts Look Like
medium.com
What SSH Hacking Attempts Look Like
1–10 of 186 posts
Re: What SSH Hacking Attempts Look Like
#2Fairly standard stuff, definitely interesting to see all the IoT credentials attempred.
I'd recommend SSHGuard over fail2ban though, I seem to remember the version of fail2ban in the Debian repos completely choking on IPv6 and failing open which is obviously undesirable.
Re: What SSH Hacking Attempts Look Like
#3 $ grep -c sshd /etc/hosts.deny
1192
$ uptime
11:58:51 up 327 days, 21:33, 1 user, load average: 0.13, 0.11, 0.09
Re: What SSH Hacking Attempts Look Like
#4I never understood why people would use fail2ban or similar approaches. Just set proper password and move on. SSH traffic is tiny, it's not a problem. You'll never be hacked with a proper password. Let them waste their time.
Re: What SSH Hacking Attempts Look Like
#5I never understood why people would use fail2ban or similar approaches. Just set proper password and move on. SSH traffic is tiny, it's not a problem. You'll never be hacked with a proper password. Let them waste their time.
[deleted]
Re: What SSH Hacking Attempts Look Like
#6My current take:
nftables instead of iptables
port-knocking
non-standard port
key+pass access/auth
ip whitelist
good logging
ED25519 wherever possible!!!
Re: What SSH Hacking Attempts Look Like
#7I never understood why people would use fail2ban or similar approaches. Just set proper password and move on. SSH traffic is tiny, it's not a problem. You'll never be hacked with a proper password. Let them waste their time.
The failed attempts make it harder to monitor for other attacks because of the noise in log files, network traffic, etc. and if an attacker IP is blocked early they can't try more effective attacks.
Re: What SSH Hacking Attempts Look Like
#8I never understood why people would use fail2ban or similar approaches. Just set proper password and move on. SSH traffic is tiny, it's not a problem. You'll never be hacked with a proper password. Let them waste their time.
The failed attempts make it harder to monitor for other attacks because of the noise in log files, network traffic, etc. and if an attacker IP is blocked early they can't try more effective attacks.
I've set up a second obstacle by allowing access to the device from a certain range of IPs on the router. Cleaned up the log pretty good.
Re: What SSH Hacking Attempts Look Like
#9Earlier quoted context omitted.
The failed attempts make it harder to monitor for other attacks because of the noise in log files, network traffic, etc. and if an attacker IP is blocked early they can't try more effective attacks.
I've set up a second obstacle by allowing access to the device from a certain range of IPs on the router. Cleaned up the log pretty good.
logins can be delayed [0] and TOTP can be used in conjunction with SSH (without google authenticator)
[0] https://unix.stackexchange.com/questions/105553/how-to-provi...
edit:
quick and dirty notes of my setup [1]
Re: What SSH Hacking Attempts Look Like
#10I never understood why people would use fail2ban or similar approaches. Just set proper password and move on. SSH traffic is tiny, it's not a problem. You'll never be hacked with a proper password. Let them waste their time.
Another more secure option is just to only allow key auth.