How to Protect Your Infrastructure Against the Basic Attacker

Re:How to Protect Your Infrastructure Against the Basic Atta... by simon_vetter on Wednesday January 06, 2016 @12:22PM (#10851830)

This. At least, if you're not ready to accept incoming v6 connections (which really isn't hard to do), use connection tracking to let outbound v6 through and add the necessary icmpv6 accept rules.

ufw comes pre-installed on ubuntu and is dead simple to use, there's really no reason not to use it.

  # ufw allow 22/tcp
  # ufw enable

should be all you need to have connection tracking on both v6 and v4, have a tried and trusted icmpv6 accept list, and keep your v6 and v4 firewalls in sync.

[ Parent | on HN ]

Re:How to Protect Your Infrastructure Against the Basic Atta... by mordechai9000 on Wednesday January 06, 2016 @02:01PM (#10852732)

I like to use a limit rule (ufw limit 22/tcp) for SSH, to discourage brute force attacks. If nothing else, it will help reduce the noise in the log files.

This isn't a replacement for basic precautions such as disabling root login and not allowing password authentication, of course.

[ Parent | on HN ]

Re:How to Protect Your Infrastructure Against the Basic Atta... by zwetan on Wednesday January 06, 2016 @11:10PM (#10855923)

I prefer to not limit SSH but use fail2ban instead to remove the noise.

[ Parent | on HN ]