101–110 of 149 posts
I get keys are better than passwords, but how do you enforce key rotation for non-technical users when they can barely manage to changer their passwords? I much prefer 2FA than keys for non-technical users.
In a sane configuration, the only thing a tool like this should be doing for you is keeping your logs clear. If you're deploying something to mitigate the risk of brute-force attacks on your server, the problem is that it's possible to brute-force your server, not that you don't have an autoblocking system enabled. These tools are popular, but I think they're kind of silly. Later I read some comments below, which com…
But it's even scarier: it's written in C. I don't want to defend this tool, but OpenSSH is written in C as well :).
https://www.sshguard.net/docs.html
The setting up link points at https://web.archive.org/web/20180901061425/https://www.sshgu... and the original is 404: https://www.sshguard.net/docs/setup/
why not ufw ? Isn't it widely used?
Earlier quoted context omitted.
When I still ran my own server it was a pretty heavy load, like 30% or so. Much more than a minor nuisance. But it was a SPARC server with 1 core at a few hundred MHz and no crypto acceleration. As you can tell this is a while ago :) So yeah I guess these days it's much less of an issue. But the number of possible attempts will have increased too of course.
I figured I might as well go pull up some numbers from my personal systems. I've got 3 internet-facing VMs that expose SSH to the world. For the past 30 days, I've seen a combined total of 86k SSH attempts. I've not bothered to filter out my own legitimate sessions, given that they're in the ballpark of ~3 connections a day tops. Total load on each of these systems has stayed below 0.5, and that's including the other…
If it's using systemd, try
systemctl status sshd
If not, you can enable it with:
systemctl edit sshd
[Service]
CPUAccounting=yes
Earlier quoted context omitted.
It's not TCP based so you can't port scan it like SSH, and it will only respond on successful authentication, so a failed attempt is undistinguishable from it not being there. It is also fairly easy to DoS SSH by having too many connections in the authentication state leaving no slots open, which SSHGuard is useful to counter. Apart from that, SSH's intrinsic security is the same, but if you have password authenticat…
> Apart from that, SSH's intrinsic security is the same, but if you have password authentication enabled, you are only as strong as the weakest password. A number of configurations also ship with ssh root login enabled by default. For example if you setup a new Linode VPS. You need to add a user, remember to at least turn off root access and probably also password access. I get why they're doing it because it easier,…
mmm I use ubuntu and ufw... so I guess this won't work(?) why not ufw ? Isn't it widely used?
https://www.daemonology.net/blog/2012-08-30-protecting-sshd-...
In a sane configuration, the only thing a tool like this should be doing for you is keeping your logs clear. If you're deploying something to mitigate the risk of brute-force attacks on your server, the problem is that it's possible to brute-force your server, not that you don't have an autoblocking system enabled. These tools are popular, but I think they're kind of silly. Later I read some comments below, which com…
I _WANT_ to harvest IP's of PC's trying to SSH into any of my servers. I want them because then I can block ALL traffic coming from their IP's. At my last gig, I had thousands of domains and hundreds of servers running on every major (and a shitload of minor) service provider. I custom scripted all these servers to compile all the IP's that attempted a connection, send those lists back to HQ, and then distribute back…
While its similar to sshguard or blocklistd, I didn't know they existed when badips died a couple years back. https://www.nubi-network.com/faq.php
The list file should work for either ingress or egress (or both).
I wanted to post about it on here some time ago, but I'm kindof bad at advertising.
In a sane configuration, the only thing a tool like this should be doing for you is keeping your logs clear. If you're deploying something to mitigate the risk of brute-force attacks on your server, the problem is that it's possible to brute-force your server, not that you don't have an autoblocking system enabled. These tools are popular, but I think they're kind of silly. Later I read some comments below, which com…