Back

@marcofanti89 @mike

I've heard that, although I don't fully understand the reasoning.

@DrHyde @mike

Isn't that basically fail2ban?

I've heard people say that isn't enough, as well.

@RL_Dane @mike yeah, same idea. It’s not enough to be foolproof cos an attacker could just use multiple source IPs but like all security the aim is to make an attack harder, not to make it impossible.

@DrHyde @mike

That tracks

@vitSkalicky @mike yes, disabling password auth and enabling fail2ban are the two essential configurations I do on every system that needs public ssh.

We once took over a legacy server from another company, with some software we planned to migrate. As the server was supposed to be put out of service nobody paid much attention to the config. Turned out it had password auth enabled and likely a weak password. Took only a couple of days and the system was breached and backdoored :/

@outsidecontext @mike But does fail2ban achieve anything useful if password auth is disabled?

@vitSkalicky @mike less so, but I think it still helps to discourage attackers from probing the server. And certain security issues often still require attackers to try many requests.