How to harden against SSH brute-forcing?

[callcc@lemmy.world]

Ok, fair point. But why stop at one vpn? I choose to trust OpenSSH, but I agree that adding a secondary layer of security actually helps here. You basically multiply two very low probabilities to get an even lower one. The trade-off is that you add complexity. You now need to keep two services up to date, and correctly configured and access/key material distributed.

I'd only recommend this setup for projects with special security requirements.

[callcc@lemmy.world]

I don't agree about the point concerning cost. You have additional training, update, maintenance and config burden. This on top of the burdon of using the VPN on top of ssh.

[sugar_in_your_tea@sh.itjust.works]

Fail2ban blocks IPs that fail to connect repeatedly. A honeypot pretends fails worked and gives them a worthless environment to try to exploit. The purpose of fail2ban is to block attacks, the purpose of a honeypot is amusement and to waste attackers' time.

[callcc@lemmy.world]

Be sure to use a passphrase

[Guest]

I understood the comment as "leave the port open to ssh, to easily allow fail2ban to hit the ip's before they get through your full port range." But thanks for the elaborate answer

I agree, what you described is much more work

[sugar_in_your_tea@sh.itjust.works]

It's also one of the biggest targets for attack. Here's a somewhat recent CVE and here is another. Staying on top of security patches is absolutely critical, and many don't do that.

The best security practice is to layer your protections.

your points 4 and 5 are outside the scope of the SSH discussion

They're not about SSH, sure, but they are relevant to securing a system to remote access. Always assume your security infra will be compromised and plan accordingly. Generally speaking, the more layers, the better.

[a_postmodern_hat@lemmy.world]

You could get a hardware key (like a Yubikey) and authenticate with PIV or GPG.

[tomsh@lemmy.world]

In addition to what others say, I also have ntfy notifications on successful login.

[voroxpete@sh.itjust.works]

This is the selfhosted community; Who are you training? In most cases there's literally only one person who would ever need SSH access to this server. Maybe two or three in a tiny handful of cases, but anyone who can't figure out Netbird in 30 seconds absolutely should not be accessing anything via SSH.

And you've clearly never used Netbird, Tailscale, or any similar service, if you think that update, maintenance and config constitute any kind of meaningful burden, especially for something as simple as remote access to a VPS.

[sugar_in_your_tea@sh.itjust.works]

why stop at one vpn

Because an additional one adds a different type of security unrelated to securing your server, it's about securing data en route to your server (e.g. hiding that you're accessing it at all from wherever you are. Maybe you want that, but it's irrelevant to securing your server.

But on the larger topic of diminishing returns, yeah, maybe you don't need it.

However, I would never feel comfortable with just one line of defense, regardless of how good that product is. I trust openSSH, which is why I have it running, but all software has bugs and I want more than domino that needs to fall before I get pwned. If there's a successful attack on openSSH, you can bet the script kiddies will exploit it before you get around to patching your server, especially in a homelab setup.

This setup isn't particularly crazy, and I'd recommend a lot more of someone has special requirements. Setting up WireGuard is like 20 lines of config, it's baked into the kernel (except wg-quick, the frontend), and the project is super stable (no major changes in years). Pretty much everything has great support for it (built-in to Android, Linux DEs, etc), and you really don't need to touch it unless you need to set up a new machine.

But if you don't want a VPN for whatever reason, there are other options for additional security:

• geoip blocking - allow only those regions that you expect to connect from (different rules for each port, so SSH can be special)
• fail2ban - block IPs if they fail to authenticate after a few attempts

But please do more than just securing openSSH, because all software has bugs and an extra layer isn't that much more work.

[loudwaterenjoyer@lemmy.dbzer0.com]

How about 22222?

[Guest]

That's genius. I'll do the same from now on.

[possiblylinux127@lemmy.zip]

Use key based auth only and then run ssh-audit.

[possiblylinux127@lemmy.zip]

Changing the port is a total waste of time

Changing the port is just like putting a picture of a window on your door. Harden SSH properly and don't waste time with security via obscurity

[sugar_in_your_tea@sh.itjust.works]

Agreed, but be careful about the whitelist. If your home IP changes, you'll be locked out until you update it, so you should consider an IP range if that's a possibility for you. Likewise, if you'll be accessing it from multiple locations (say, a family member's house), then make sure to add those as well.

[tomsh@lemmy.world]

There is actually an example on their website.

ntfy ssh login alert

[sugar_in_your_tea@sh.itjust.works]

That's not true.

Security through obscurity isn't real security, sure, but it does a lot to reduce the noise in the logs so you can see the more real attacks. Hardening SSH properly is certainly more important, but changing the port also has value.

[sugar_in_your_tea@sh.itjust.works]

I do log in as root though.

Don't do that. You're one local piece of malware away from getting your server pwned. Logging in as an unprivileged user at least requires another exploit on the server to get root permissions.

[sugar_in_your_tea@sh.itjust.works]

Oh, that one's fine. Everyone knows that 5-digit ports add extra security, which is why WireGuard runs on port 51820 by default. You can verify this by checking the max port number, which is also 5-digits, computers just aren't powerful enough to crack 6-digit port numbers, so Linux hasn't bothered increasing it. /s

[sugar_in_your_tea@sh.itjust.works]

harden sshd

More details:

• require keys to login
• don't allow login as root

That should be plenty, but you could go a bit further and restrict the types of algorithms allowed (e.g. disallow RSA if you're worried about quantum attacks). For this, I recommend a subtractive config (e.g. HostbasedAcceptedAlgorithms=-rsa-*). This is way over the top since an attacker is unlikely to attack the cipher directly, but it could be part of an attack.