So it’s my first time setting up a VPS. Is it to be expected to ban 54 IPs over a 12h timespan? The real question for me is whether this is normal or too much.
$ sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
| |- Currently failed: 3
| |- Total failed: 586
| `- Journal matches: _SYSTEMD_UNIT=ssh.service + _COMM=sshd
`- Actions
|- Currently banned: 51
|- Total banned: 54
`- Banned IP list: [list of IPs]
fail2ban sshd.conf
$ sudo cat /etc/fail2ban/jail.d/sshd.conf
[sshd]
enabled = true
mode = aggressive
port = ssh
backend = systemd
maxretry = 3
findtime = 600
bantime = 86400
I have disabled SSH login via password. And only allow it over an SSH key.
$ sudo sshd -T | grep -E -i 'ChallengeResponseAuthentication|PasswordAuthentication|UsePAM|PermitRootLogin'
usepam no
permitrootlogin no
passwordauthentication no
Mostly true, however the thing saving you would be host key verification, not pubkey authentication.
I’m just not into security by obscurity coupled with compromising the inbuilt mechanisms for making sure only root can open an SSHd.
Do you think high ports are irrelevant or only in this case for SSHd? If the former, why do you think the distinction exists in the first place?
host key veryfication, right, good point! non-root attacker won’t have your servers key. but thats just on top. so even if you ack the new host key, what could they gain? give you a shell with their permission and wait for you to sudo-tell them their password maybe. until then trying to mimic the system they might not know too much about (whats in /root?)