Tired of these ssh probing bots!


I manage a few Linux servers at different places. I use SSH for that purpose, but I noticed that keeping port 22 open was like a light sign to the Internet hacking community. I do not feel comfortable knowing that my servers are subject to constant probing from other already hacked computers. I moved the servers to non-standard ports to keep most of the noise away, but it seems that is not enough nowadays, as I can see a bunch of hosts trying what I guess are common root passwords over and over again or some known SSH brute-forcing attacks.

I keep the password login option open as I never know where I may need to connect from. So, there is a non-zero chance that my password could be guessed. So, I am now giving it a go to the fail2ban tool. As the name suggests, it will ban attackers' addresses after a programmable number of login fails. I hope this will remove some noise from /var/log/auth.log


Comments

Popular posts from this blog

VFD control with Arduino using RS485 link

How to get sinusoidal s-curve for a stepper motor

Importing OpenSCAD designs into Onshape