This is 100% the way to go. I spun up a new server for a public-facing site on my VPS and I wondered if I really needed fail2ban. Within ten minutes of setting it up it had already blocked four people.
Don’t open port 22 if you can help it. Use it on your local network and VPN in if you need to use it offsite.
That is part of my bootstrap ansible playbook, which in addition to create user, setting key, etc., will definitely disable root and password login, enable max tries and setup f2b. I am not necessarily afraid of exposing ssh to the internet (it is a service designed for it), but I drastically reduce the risk this way. I am thinking of also changing port to simply get less logs.
There’s no reason to allow root login, it’s asking for trouble. Password based login is even worse. Changing the SSH port just makes it harder for the drive-by bots trying the whole IPv4 range
How many of you actually disable root and password based login, change the default SSH port, and setup fail2ban?
I just don’t put SSH on the internet at all.
This is 100% the way to go. I spun up a new server for a public-facing site on my VPS and I wondered if I really needed fail2ban. Within ten minutes of setting it up it had already blocked four people.
Don’t open port 22 if you can help it. Use it on your local network and VPN in if you need to use it offsite.
This is actually solid advice to quell any worries
That is part of my bootstrap ansible playbook, which in addition to create user, setting key, etc., will definitely disable root and password login, enable max tries and setup f2b. I am not necessarily afraid of exposing ssh to the internet (it is a service designed for it), but I drastically reduce the risk this way. I am thinking of also changing port to simply get less logs.
Is fail2ban not enough?
There’s no reason to allow root login, it’s asking for trouble. Password based login is even worse. Changing the SSH port just makes it harder for the drive-by bots trying the whole IPv4 range