So it’s my first time setting up a VPS. Is it to be expected to ban 54 IPs over a 12h timespan? The real question for me is whether this is normal or too much.

$ sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 3
|  |- Total failed:     586
|  `- Journal matches:  _SYSTEMD_UNIT=ssh.service + _COMM=sshd
`- Actions
   |- Currently banned: 51
   |- Total banned:     54
   `- Banned IP list:   [list of IPs]

fail2ban sshd.conf

$ sudo cat /etc/fail2ban/jail.d/sshd.conf 
[sshd]
enabled = true
mode = aggressive
port = ssh
backend = systemd
maxretry = 3
findtime = 600
bantime = 86400

I have disabled SSH login via password. And only allow it over an SSH key.

$ sudo sshd -T | grep -E -i 'ChallengeResponseAuthentication|PasswordAuthentication|UsePAM|PermitRootLogin'
usepam no
permitrootlogin no
passwordauthentication no
  • nibbler@discuss.tchncs.deEnglish
    4·
    11 hours ago

    so everyone can open them… so what? attacker who already gained local access can crash your original sshd and spin up his own one? admittedly a thinkable scenario… but can this even be abused in a pubkey auth scenario?

    • Helix 🧬@feddit.orgEnglish
      1·
      25 minutes ago

      Mostly true, however the thing saving you would be host key verification, not pubkey authentication.

      I’m just not into security by obscurity coupled with compromising the inbuilt mechanisms for making sure only root can open an SSHd.

      Do you think high ports are irrelevant or only in this case for SSHd? If the former, why do you think the distinction exists in the first place?

      • nibbler@discuss.tchncs.deEnglish
        1·
        19 minutes ago

        host key veryfication, right, good point! non-root attacker won’t have your servers key. but thats just on top. so even if you ack the new host key, what could they gain? give you a shell with their permission and wait for you to sudo-tell them their password maybe. until then trying to mimic the system they might not know too much about (whats in /root?)

    • mavu@discuss.tchncs.deEnglish
      3·
      11 hours ago

      I don’t see a reason to worry about that. Only matters if the machine is alreay compromised, and then it doesn’t matter either.

      • Helix 🧬@feddit.orgEnglish
        1·
        23 minutes ago

        There are different levels of compromise: you could have local access or root access. This might allow a hacker to gain root access by faking an SSHd and asking for a password or something like that. Host key verification would save you in that case, but then again, there’s probably funny MITM things you can do with an existing SSHd.