# cat /etc/ssh/sshd_config | grep PasswordAuthentication
PasswordAuthentication no
^ it should return that. The end.
What SSH Hacking Attempts Look Like
31–40 of 186 posts
Re: What SSH Hacking Attempts Look Like
#32Earlier quoted context omitted.
What benefit does port knocking add to having a key auth only setup?
What benefit does locking the glass doors into a bank add to having time-locked vault? Defense in depth.
The vault and the locked glass doors defend against entirely different things. Same doesn’t really apply for ssh keys and port knocking.
Re: What SSH Hacking Attempts Look Like
#33This all is easy if you only get a handful of login attempts. But when you get more, and more, it becomes an issue. On one of my servers it got so bad that SSH was at the end constantly using an entire CPU core. I don’t have logs from that server, but here are logs – just the failed attempts – of 2 months from a server that was less severely affected: https://s3.kuschku.de/public/failed_ssh [327M] And that was despit…
Fail2Ban and psad will do wonders for that.
Re: What SSH Hacking Attempts Look Like
#34Earlier quoted context omitted.
I have SSH with key auth everywhere, so I have no security worries. But when sshd ends up pegging an entire core, and I can't login myself anymore, then fail2ban (or even whitelisting IP ranges for ssh) becomes necessary.
That would be problematic, but I never encountered that. I'm using cheapest VPS with public IP and without any additional protections. I just checked and its load average is 0.00, so load is non-existant.
[deleted]
Re: What SSH Hacking Attempts Look Like
#35This all is easy if you only get a handful of login attempts. But when you get more, and more, it becomes an issue. On one of my servers it got so bad that SSH was at the end constantly using an entire CPU core. I don’t have logs from that server, but here are logs – just the failed attempts – of 2 months from a server that was less severely affected: https://s3.kuschku.de/public/failed_ssh [327M] And that was despit…
Fail2Ban and psad will do wonders for that.
Yeah, I now simply removed 0.0.0.0/0 dport 22 from the whitelist and only added a select few IP ranges. That has calmed the storm significantly, and if an IP from this range (my ISP) tries it anyway I can contact my ISP (a small local ISP) to take that down.
Re: What SSH Hacking Attempts Look Like
#36The numbers on https://cdn-images-1.medium.com/max/1600/1*47UCBwMdQGFNtk2ao... look very suspicious.
Looks like the graph was generated from the Top 10 only. Obviously every item appears exactly once, so they all have the same 10%. The presentation as a graph is useless.
Re: What SSH Hacking Attempts Look Like
#37I never understood why people would use fail2ban or similar approaches. Just set proper password and move on. SSH traffic is tiny, it's not a problem. You'll never be hacked with a proper password. Let them waste their time.
You aren't infallible. While it's easy enough to secure a minimal server with only SSH access, every time you add another service, provide access to a new user, or change a configuration, there's a chance you'll miss something or make a dumb mistake. Running Fail2Ban is a very cheap and easy method to ensure that, even if you do fuck up somewhere, there's another layer of security that should prevent malicious access in most cases (nothing will save you if you set the pass to admin/admin, e.g.).
Re: What SSH Hacking Attempts Look Like
#38My current take: nftables instead of iptables port-knocking non-standard port key+pass access/auth ip whitelist good logging ED25519 wherever possible!!!
why nftables rather than iptables?
Re: What SSH Hacking Attempts Look Like
#39My current take: nftables instead of iptables port-knocking non-standard port key+pass access/auth ip whitelist good logging ED25519 wherever possible!!!
IP whitelist is tough when your home network has a dynamic IP.
I called up my provider and paid a little extra for a fixed IP. Really it was just laziness though because in practice my home IP seemed to only change when I restarted the router.
Re: What SSH Hacking Attempts Look Like
#40# cat /etc/ssh/sshd_config | grep PasswordAuthentication PasswordAuthentication no ^ it should return that. The end.
Is it worth mentioning useless uses of cat in this day and age?