News for hackers. Stuff that matters.

A comment on What SSH Hacking Attempts Look Like. Parent comment

Re:What SSH Hacking Attempts Look Like by beagle3 on Saturday May 05, 2018 @09:23AM (#17001697)
Do you ever examine logs? Fail2ban (or even better, using a nonstandard port or both) keep the noise out of lots to the point that you can still examine them manually.

Without it, 99.99% of the average ssh log is failed back attempts.

[ Parent | on HN ]
Re:What SSH Hacking Attempts Look Like by nerdponx on Saturday May 05, 2018 @09:37AM (#17001738)
Changing the port away from 22 also had that effect in my experience.
[ Parent | on HN ]
Re:What SSH Hacking Attempts Look Like by purple-again on Saturday May 05, 2018 @10:02AM (#17001827)
This was like night and day. Non stop constant barrages on the default port, all quiet on the ssh k@ip -p XXX.
[ Parent | on HN ]
Re:What SSH Hacking Attempts Look Like by yjftsjthsd-h on Saturday May 05, 2018 @06:38PM (#17004263)
I found that setting the port and user in ~/.ssh/config made everything way easier. Also fill in the IP as HostName if you're not using DNS names.
[ Parent | on HN ]