How to harden against SSH brute-forcing?

[sugar_in_your_tea@sh.itjust.works]

It's absolutely overboard, and you can get 99% of the way there with this:

1. WireGuard config (Tailscale in your case)
2. Bind SSH to WireGuard IP only (so no public SSH port)
3. SSH keys only, and disable root login over SSH

That will require breaking WireGuard and openSSH's key-based authentication, which just isn't happening. The rest looks like mostly auditing. Even a firewall isn't necessary if no ports are accessible anyway (i.e. everything only accessible over Tailscale), and you can just configure iptables to block everything on the WAN IP and call it a day.

[sugar_in_your_tea@sh.itjust.works]

Just remember that you'll only be able to SSH in w/ a device that's already configured for WireGuard. So if you're at a friend's house and haven't set up your phone to do it yet, you'll be forced to use the VPS console to get in. Make sure this is what you want before you do it.

[australiansimon@lemmy.world]

I think the point behind it is to waste the sniffers time sniffing for ports that it could be using to be making attempts.

Its not a security thing, it's just increasing the cost to snoop.

[zr0@lemmy.dbzer0.com]

Yeah, I see your point. No use to repeat the same you can read in other comments or in those 274772 guides online. I was trying to imply to just generally harden ssh because then brute-force attempts should be no issue, unless you log everything and the disk space gets maxed out

[lefixxx@lemmy.world]

Change the port.

[irmadlad@lemmy.world]

sugar_in_your_tea
@sh.itjust.works

It's nice to be commented by someone famous.

Open up the window, let some air into this room
I think I'm almost chokin' from the smell of stale perfume
And that cigarette you're smokin' 'bout scare me half to death
Open up the window, sucker, let me catch my breath

[sugar_in_your_tea@sh.itjust.works]

Mama told me not to come.

Fun fact, my usernames on Reddit (I would cycle them every couple of years) were all Three Dog Night lyrics, so I continued the theme on Lemmy.

[downhomechunk@midwest.social]

I'd get myself banned this way. I forget the -p flag at least once per week.

[gerowen@lemmy.world]

Generate a unique key for each client or device. SSH keys identify devices, not people, so I do not recommend sharing the same key between two different devices.

[lichtmetzger@discuss.tchncs.de]

Use knockd and iptables, gone are the fucking bots.

[boblemmy@lemmy.world]

change port + fail2ban + totp 2fa

[aeternum@lemmy.blahaj.zone]

in addition to what others have said, disable root login

[structureofchaos@lemmynsfw.com]

Well, you might have only 1 main client, but if that hardware fails and need to connect from a temporary client or after a fresh install you're out of your own server...

[appoxo@lemmy.dbzer0.com]

You could limit the firewall to IP range(s) of your domestic (and other places of interest like work) connection.
This way they won't come even close to even logging in.
And then you could do the other hardening on top.