101–110 of 268 posts
Earlier quoted context omitted.
Disable password authentication and fail2ban becomes completely unnecessary.
This. I really do not understand why people use fail2ban when the threat is somewhere else. It won't stop a ddos but will certainly, at some point, prevent you from logging in.
You'd think that would be enough for them to stop, but I have some IPs with 25k connection attempts over a 90 day span. (Of course it had to be someone using digitalocean)
Earlier quoted context omitted.
I do. For some reason ssh keys became the group-think security advice to repeat ad nauseam. I often find people have only considered this very shallowly, and their reasoning is just "But OMG, entropy lolz" without actually seriously considering the available entropy and likely attack vectors and failure. Why? The benefits are largely theoretical if you choose sufficiently strong randomly generated passphrases, with s…
> ... need to login to another machine from a new machine that doesn't have the ssh-key. > gateway/proxy/vpn entry to my network has all my ssh keys on it, and it becomes compromised because of some 0-day, the attacker now basically has access to... multiple entire networks That's why you use SSH agent forwarding https://docs.github.com/en/authentication/connecting-to-gith... , so you never need to copy the private k…
Earlier quoted context omitted.
Who still allows password-based login for any SSH account, root or not? Keys, certificates, or Kerberos for all users.
I do. For some reason ssh keys became the group-think security advice to repeat ad nauseam. I often find people have only considered this very shallowly, and their reasoning is just "But OMG, entropy lolz" without actually seriously considering the available entropy and likely attack vectors and failure. Why? The benefits are largely theoretical if you choose sufficiently strong randomly generated passphrases, with s…
Your private keys shouldn't even be accessible to you, they should be on a secure enclave like a yubikey, and you should forward the token along the chains. No risks, and basically painless, especially if you switch to certs so you don't even have to know the public keys ahead of time on the servers, just all trust the same private PKI.
Earlier quoted context omitted.
I tried the IP resolved by the domain "brute.fail" but it doesn't accept SSH connections :)
The Internet is not that big, though. You could potentially try all 2^32 IPv4 addresses with your password of choice and see when it came up here.
Earlier quoted context omitted.
I'd be cautious about stuff like this - if you annoy the wrong person that could paint a target on your back.
They're impotent little weasels who couldn't hit a target the size of a barn, so the risk is minimal.
be careful, this website is easy to vandalize
Earlier quoted context omitted.
Disable password authentication and fail2ban becomes completely unnecessary.
This. I really do not understand why people use fail2ban when the threat is somewhere else. It won't stop a ddos but will certainly, at some point, prevent you from logging in.
Fail2ban keeps my log short enough that I can review them daily, I don't have to sift through thousands of login attempt.
> It won't stop a ddos but will certainly, at some point, prevent you from logging in.
Yup, losing my key and having no password access will do that.
I have an RDP server open to the internet(on a custom port) and it just receives an absolutely relentless stream of login attempts with all kinds of random logins. That's a private server on a private home IP, not associated with a known domain or anything. Changing the port stops it for about 24 hours then it starts again.
I know nothing about networking, so pardon the ignorance: Why isn't there (or is there) some kind of service you can use to map some crazy URL to your personalip:port, like... http://obscuremyshit.com/393nnasjhf83u98723401 = personalip:port And only when a connection is referred from that source, does the RDP server even expose itself? And for all other traffic that hits personalip:port, it does absolutely nothing?
You might be able to do this by responding with a hyperlink which points to ssh://x.x.x.x:1234
Some browsers will recognize that format and pass to an ssh client application to spawn an appropriate ssh connection.
The reason why it's not a worthwhile idea is that there is a limit of 65535 ports to chose from on a given IP address and they all can be scanned pretty quickly in order to locate an active SSH service port. This really makes the URL idea ineffective.
Port-knocking may be a little bit more effective because the SSH service will not reply to a connection request unless you've attempted to establish a connection on a different port first. Scanning for an open SSH service becomes much more difficult.
A remark on your fail.js, since you’re engaging here and I figure this could interest you or others: Once there are more than thirty rows, you fade rows in like this: row.style.opacity = 0; let intervalId = setInterval(function() { opacity = Number(window.getComputedStyle(row).getPropertyValue("opacity")); if (opacity This would be better done with a CSS animation or transition—it takes less code, and is smoother. My…