Show HN: A proactive way of securing your Linux server

Re:Show HN: A proactive way of securing your Linux server by oehtXRwMkIs on Thursday September 03, 2020 @02:29PM (#24367130)

If I have public key authentication set up for ssh, should I even bother with fail2ban, firewalld-rest, port knocking, etc.? There's no way anyone is brute forcing my ed25519 key, so what's the point? Sure security should be layered and all that but it seems like public key auth is so strong by itself anything on top seems unnecessary.

[ Parent | on HN ]

Re:Show HN: A proactive way of securing your Linux server by RL_Quine on Thursday September 03, 2020 @03:17PM (#24367682)

There's no point to this at all, it's just making services more fragile.

If "brute force" attacks are a concern, you are a fool that has password authentication turned on.

If you have password authentication turned off, why does it matter?

[ Parent | on HN ]

Re:Show HN: A proactive way of securing your Linux server by calvinmorrison on Thursday September 03, 2020 @07:34PM (#24370064)

Given some other attacks to ssh over the years, isn't it safer to use fail2ban

[ Parent | on HN ]

Re:Show HN: A proactive way of securing your Linux server by fmajid on Thursday September 03, 2020 @03:34PM (#24367851)

It's very easy for brute-force attacks from botnets to consume all your SSH process slots and then you are locked out.

[ Parent | on HN ]

Re:Show HN: A proactive way of securing your Linux server by roveo on Thursday September 03, 2020 @04:17PM (#24368396)

Can confirm, had this problem the other day. CI started failing and after a short investigation I figured out sshd was just dropping my connections. Installed fail2ban first, but then just used a firewall since all valid IPs are known.

[ Parent | on HN ]

Re:Show HN: A proactive way of securing your Linux server by joana035 on Thursday September 03, 2020 @06:13PM (#24369490)

That ain't the truth.

[ Parent | on HN ]

Re:Show HN: A proactive way of securing your Linux server by avtar on Thursday September 03, 2020 @02:35PM (#24367212)

> If I have public key authentication set up for ssh, should I even bother with fail2ban

If someone's bruteforcing their way in via ssh it's probably worthwhile blocking them before they start trying other services.

[ Parent | on HN ]

Re:Show HN: A proactive way of securing your Linux server by jooize on Thursday September 03, 2020 @03:14PM (#24367640)

Might protect against some ludicrous attack that we're not considering. Limiting attempts seems to me to always be a good idea.

[ Parent | on HN ]

Re:Show HN: A proactive way of securing your Linux server by yearoflinux on Thursday September 03, 2020 @03:43PM (#24367970)

You are reducing attack vectors. How do you know your ssh implementation is secure?

[ Parent | on HN ]

Re:Show HN: A proactive way of securing your Linux server by jschwartzi on Friday September 04, 2020 @10:22AM (#24375152)

How can you find out if you only get three tries a month?

[ Parent | on HN ]