How to harden against SSH brute-forcing?

[someacnt@sh.itjust.works]

Thanks a lot! Geoblocking makes a lot of sense, will try!

[sugar_in_your_tea@sh.itjust.works]

I highly recommend using key-based SSH authentication exclusively for all users on your server, and disallow root login as well.

Geoblocking mostly cuts down on the spam, but also constrains where an actual attack can come from. If there's some kind of zero-day attack on SSH, this will dramatically reduce the risk you're hit.

[moonpiedumplings@programming.dev]

Again, this is distracting from the original argument to make some kind of tertiary argument unrelated to the original one: Is ssh secure to expose to the internet?

You said no. And that statement is inorrect.

[someacnt@sh.itjust.works]

Thanks, I will try fail2ban. I am using ED25519 for ssh keys, it seems like it's the best defense on the ssh side.
Do you happen to know why this kind of attack is so prevalent?

[someacnt@sh.itjust.works]

Fortunately my VPS (oracle) has set SSH authentication to be default. Disallowing root login sounds good, gotta try that as well.

[joshcodes@programming.dev]

100% agree, that is a "totally for fun" exercise

[arghblarg@lemmy.ca]

There's a dedicated tool named sshguard which works nicely.

[db0@lemmy.dbzer0.com]

No Port-knocking? Amateurs! /s

[Guest]

Thank for that! You just turned a student onto a new tool to play with.

[Guest]

did you mean crowdsec instead of crowdstrike?

[whyjiffie@sh.itjust.works]

I'm not them, but among other reasons they are looking to build botnets (cryptomining, dosing, mass crawling), and they are searching for hosts with low security (or if you just made a mistake)

[null_dot@lemmy.dbzer0.com]

This is what I do. Changing the port to a higher number will prevent almost all bots.

I understand that obscurity is not security but not getting probed is nice.

Also ssh keys are a must.

I do log in as root though.

However, I block all IPs other than mine from connecting to this port in my host's firewall. I only need to log in from home, or my office, and in a crisis I can just log in to OVH and add whitelist my IP.

[kylian0087@lemmy.dbzer0.com]

Configure the firewall with a IP whitelist to only allow connections to ssh be made from your home IP.

Other then that, disable password logon for ssh and setup up key based authentication.

[zr0@lemmy.dbzer0.com]

Fml… yes, I meant CrowdSec. Thanks for the hint

[whodatdair@lemmy.blahaj.zone]

Vietnam stare

[troed@fedia.io]

Still no. Here's the reasoning: A well known SSHd is the most secure codebase you'll find out there. With key-based login only, it's not possible to brute force entry. Thus, changing port or running fail2ban doesn't add anything to the security of your system, it just gets rid of bot login log entries and some - very minimal - resource usage.

If there's a public SSHd exploit out, attackers will portscan and and find your SSHd anyway. If there's a 0-day out it's the same.

(your points 4 and 5 are outside the scope of the SSH discussion)

[structureofchaos@lemmynsfw.com]

Regarding SSH Keys, I was wondering how you keep your key safe and potentially usable from another client?

[Guest]

By all means, I am no expert, but isn't it "just" the fail2ban?

[plz1@lemmy.world]

Does SSH have to be your only way? Could you deploy something like Tailscale? Can you restrict the allowed IP ranges on SSH with a firewall rule?

[bizdelnick@lemmy.ml]

The best way is to disable password login and use SSH keys only. Any further steps are not required, but you may additionally install fail2ban or sshguard.