How to harden against SSH brute-forcing?

[tomsh@lemmy.world]

There is actually an example on their website.

ntfy ssh login alert

[sugar_in_your_tea@sh.itjust.works]

That's not true.

Security through obscurity isn't real security, sure, but it does a lot to reduce the noise in the logs so you can see the more real attacks. Hardening SSH properly is certainly more important, but changing the port also has value.

[sugar_in_your_tea@sh.itjust.works]

I do log in as root though.

Don't do that. You're one local piece of malware away from getting your server pwned. Logging in as an unprivileged user at least requires another exploit on the server to get root permissions.

[sugar_in_your_tea@sh.itjust.works]

Oh, that one's fine. Everyone knows that 5-digit ports add extra security, which is why WireGuard runs on port 51820 by default. You can verify this by checking the max port number, which is also 5-digits, computers just aren't powerful enough to crack 6-digit port numbers, so Linux hasn't bothered increasing it. /s

[sugar_in_your_tea@sh.itjust.works]

harden sshd

More details:

• require keys to login
• don't allow login as root

That should be plenty, but you could go a bit further and restrict the types of algorithms allowed (e.g. disallow RSA if you're worried about quantum attacks). For this, I recommend a subtractive config (e.g. HostbasedAcceptedAlgorithms=-rsa-*). This is way over the top since an attacker is unlikely to attack the cipher directly, but it could be part of an attack.

[k_rol@lemmy.ca]

I vote for wireguard here, I don't expose anything other than game servers to the internet

[sugar_in_your_tea@sh.itjust.works]

It's absolutely overboard, and you can get 99% of the way there with this:

1. WireGuard config (Tailscale in your case)
2. Bind SSH to WireGuard IP only (so no public SSH port)
3. SSH keys only, and disable root login over SSH

That will require breaking WireGuard and openSSH's key-based authentication, which just isn't happening. The rest looks like mostly auditing. Even a firewall isn't necessary if no ports are accessible anyway (i.e. everything only accessible over Tailscale), and you can just configure iptables to block everything on the WAN IP and call it a day.

[sugar_in_your_tea@sh.itjust.works]

Just remember that you'll only be able to SSH in w/ a device that's already configured for WireGuard. So if you're at a friend's house and haven't set up your phone to do it yet, you'll be forced to use the VPS console to get in. Make sure this is what you want before you do it.

[australiansimon@lemmy.world]

I think the point behind it is to waste the sniffers time sniffing for ports that it could be using to be making attempts.

Its not a security thing, it's just increasing the cost to snoop.

[zr0@lemmy.dbzer0.com]

Yeah, I see your point. No use to repeat the same you can read in other comments or in those 274772 guides online. I was trying to imply to just generally harden ssh because then brute-force attempts should be no issue, unless you log everything and the disk space gets maxed out

[lefixxx@lemmy.world]

Change the port.

[irmadlad@lemmy.world]

sugar_in_your_tea
@sh.itjust.works

It's nice to be commented by someone famous.

Open up the window, let some air into this room
I think I'm almost chokin' from the smell of stale perfume
And that cigarette you're smokin' 'bout scare me half to death
Open up the window, sucker, let me catch my breath

[sugar_in_your_tea@sh.itjust.works]

Mama told me not to come.

Fun fact, my usernames on Reddit (I would cycle them every couple of years) were all Three Dog Night lyrics, so I continued the theme on Lemmy.

[downhomechunk@midwest.social]

I'd get myself banned this way. I forget the -p flag at least once per week.

[gerowen@lemmy.world]

Generate a unique key for each client or device. SSH keys identify devices, not people, so I do not recommend sharing the same key between two different devices.

[lichtmetzger@discuss.tchncs.de]

Use knockd and iptables, gone are the fucking bots.

[boblemmy@lemmy.world]

change port + fail2ban + totp 2fa

[aeternum@lemmy.blahaj.zone]

in addition to what others have said, disable root login

[structureofchaos@lemmynsfw.com]

Well, you might have only 1 main client, but if that hardware fails and need to connect from a temporary client or after a fresh install you're out of your own server...

[appoxo@lemmy.dbzer0.com]

You could limit the firewall to IP range(s) of your domestic (and other places of interest like work) connection.
This way they won't come even close to even logging in.
And then you could do the other hardening on top.