So it’s my first time setting up a VPS. Is it to be expected to ban 54 IPs over a 12h timespan? The real question for me is whether this is normal or too much.
$ sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
| |- Currently failed: 3
| |- Total failed: 586
| `- Journal matches: _SYSTEMD_UNIT=ssh.service + _COMM=sshd
`- Actions
|- Currently banned: 51
|- Total banned: 54
`- Banned IP list: [list of IPs]
fail2ban sshd.conf
$ sudo cat /etc/fail2ban/jail.d/sshd.conf
[sshd]
enabled = true
mode = aggressive
port = ssh
backend = systemd
maxretry = 3
findtime = 600
bantime = 86400
I have disabled SSH login via password. And only allow it over an SSH key.
$ sudo sshd -T | grep -E -i 'ChallengeResponseAuthentication|PasswordAuthentication|UsePAM|PermitRootLogin'
usepam no
permitrootlogin no
passwordauthentication no
Wouldn’t use a high port since they’re unprivileged.
so everyone can open them… so what? attacker who already gained local access can crash your original sshd and spin up his own one? admittedly a thinkable scenario… but can this even be abused in a pubkey auth scenario?
Mostly true, however the thing saving you would be host key verification, not pubkey authentication.
I’m just not into security by obscurity coupled with compromising the inbuilt mechanisms for making sure only root can open an SSHd.
Do you think high ports are irrelevant or only in this case for SSHd? If the former, why do you think the distinction exists in the first place?
I don’t see a reason to worry about that. Only matters if the machine is alreay compromised, and then it doesn’t matter either.
There are different levels of compromise: you could have local access or root access. This might allow a hacker to gain root access by faking an SSHd and asking for a password or something like that. Host key verification would save you in that case, but then again, there’s probably funny MITM things you can do with an existing SSHd.