Re:Show HN: A proactive way of securing your Linux server
by greenie_beans on Thursday September 03, 2020 @04:40PM
(#24368646)
This is a noob question, but could you not setup fail2ban to ban bad IPs on both ports, even if you're not using SSH on one? I'm wondering if it's possible to close port 22 and set fail2ban rules to ban any IPs that try to SSH there, while changing your SSH port and also setting up fail2ban on that port, too. Does a closed port work like that?
[ Parent
| on HN ]
Re:Show HN: A proactive way of securing your Linux server
by ses1984 on Thursday September 03, 2020 @04:48PM
(#24368726)
You could have the firewall log connection attempts on port 22 and plug that into fail2ban.
Re:Show HN: A proactive way of securing your Linux server
by kelnos on Thursday September 03, 2020 @05:24PM
(#24369061)
fail2ban works by tailing authentication logs and matching regexes to find failed attempts and the IP address of the source. So if nothing is listening on the port, there won't be anything to spit out logs that fail2ban can read.
You could potentially create a fake daemon that listens on port 22 and just logs every access attempt, and set up fail2ban to block any IP that even opens a connection to the port, regardless of what they try to send over it.
Actually, I think iptables has a LOG target that can log connection attempts even without something listening, so that could work too and be much simpler.