Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Securing a Linux Server

kenhv.com

Post reply on HN
Print view View original

1–10 of 27 posts

Re: Securing a Linux Server

#5

Post by ezst »

petesergeant wrote: post #3

Is there any point in Fail2ban if you're using keys and have disabled passwords? I guess defense in depth and all that

I suppose that helps recoup some system load that otherwise would be wasted in lengthy random port/service poking

Re: Securing a Linux Server

#6

Post by Anthony-G »

petesergeant wrote: post #3

Is there any point in Fail2ban if you're using keys and have disabled passwords? I guess defense in depth and all that

> Is there any point in Fail2Ban if you're using keys and have disabled passwords?

I’d say no. Back in the mid 2000s, I used to use Fail2Ban as an extra layer of defense but users on Stack Exchange and Hacker News (like tptacek¹) convinced me that it was pointless if I’d already disabled password authentication.

To minimise noise in my logs and to have an extra layer of defense, I only allow TCP access to Port 22 (with rate-limiting) from my home ISP’s network block, my work IP address and via the Wireguard network interface (in case my home or work ISP change the IP addresses they provide to customers).

I have considered using Fail2Ban to stop spammers using too much Postfix resources but so far I’ve got away with postscreen and configuring Postfix to reject spam attempts as early as possible during the SMTP transaction. Similarly, my Apache server gets hammered with exploit attempts but I haven’t got around to investigating how useful Fail2Ban would be for minimising how much server resources are used in responding to these malicious HTTP requests.

¹ https://news.ycombinator.com/item?id=37795100#37796639

Re: Securing a Linux Server

#8

Post by techcode »

Anthony-G wrote: post #6
petesergeant wrote: post #3

Is there any point in Fail2ban if you're using keys and have disabled passwords? I guess defense in depth and all that

> Is there any point in Fail2Ban if you're using keys and have disabled passwords? I’d say no. Back in the mid 2000s, I used to use Fail2Ban as an extra layer of defense but users on Stack Exchange and Hacker News (like tptacek¹) convinced me that it was pointless if I’d already disabled password authentication. To minimise noise in my logs and to have an extra layer of defense, I only allow TCP access to Port 22 (wi…

Instead of rate limiting, more than a decade ago I started simply changing SSH port from 22 to something else.

In case I needed to proxy through home, or access something like web ui for home heating system - I simply used ssh tunnel (socks localhost etc)...

Of course now all that is simply done via WireGuard/Tailscale/etc.

Re: Securing a Linux Server

#9

Post by lagniappe »

techcode wrote: post #8
Anthony-G wrote: post #6

Earlier quoted context omitted.

> Is there any point in Fail2Ban if you're using keys and have disabled passwords? I’d say no. Back in the mid 2000s, I used to use Fail2Ban as an extra layer of defense but users on Stack Exchange and Hacker News (like tptacek¹) convinced me that it was pointless if I’d already disabled password authentication. To minimise noise in my logs and to have an extra layer of defense, I only allow TCP access to Port 22 (wi…

Instead of rate limiting, more than a decade ago I started simply changing SSH port from 22 to something else. In case I needed to proxy through home, or access something like web ui for home heating system - I simply used ssh tunnel (socks localhost etc)... Of course now all that is simply done via WireGuard/Tailscale/etc.

I'd even go one step further and say portknocking would do a lot of good too, in addition to changing the default SSH port.
Post reply on HN