News for hackers. Stuff that matters.

A comment on Changes sshd port every 30 seconds, using Two Factor Auth to login. Parent comment

Re:Changes sshd port every 30 seconds, using Two Factor Auth... by munin on Sunday May 29, 2016 @10:15AM (#11796434)
> blacklist IPs that hit unknown ports

so what happens when someone hits an unknown port on your system from every IP on the internet?

[ Parent | on HN ]
Re:Changes sshd port every 30 seconds, using Two Factor Auth... by developer2 on Sunday May 29, 2016 @10:38AM (#11796495)
You reject all packets from "bad IPs" for a period of time. 5 minutes, 30 minutes, whatever. If you're in a position to spoof IPs and you manage to spoof one I need to connect from (or I make a mistake and get myself blacklisted), it's a temporary inconvenience.

That, and having out-of-band access to the server always helps. ;)

[ Parent | on HN ]