Tosh: Changing your SSH server's listen address every 30 seconds based on TOTP

Re:Tosh: Changing your SSH server's listen address every 30 ... by walrus01 on Saturday May 22, 2021 @10:40PM (#27252002)

I don't think anyone but the most uninformed would argue that fail2ban is an actual secure measure, it's more of a log file annoyance reducer. Obviously if you leave remote root enabled and the root password is one of a few dozen thousand common words that exist out there in public-domain password data sets, fail2ban isn't going to help much. As with the example of all the random botnet things out there that randomly try a popular list of dozens of common usernames (admin, root, webmaster, etc) with common passwords.

With things other than SSH it can also be effective in the most rudimentary first level filtering out of spam, various things that attempt to relay mail through my server get themselves first banned, and then banned for a longer time after they keep re-trying. Again with primarily the goal of having less cluttered postfix logs.

[ Parent | on HN ]

Re:Tosh: Changing your SSH server's listen address every 30 ... by lamontcg on Sunday May 23, 2021 @01:46PM (#27256962)

fail2ban is the same as having high number of rounds on password hashes to slow down attackers, and it takes about 30 seconds to install+configure. it makes a lot more sense than the title here, but is only useful as security-in-depth and can't replace other good practices. high rounds on a password hash is also equally useless if you use "password123" or something like that.

i've also seen significant reductions in idle cpu by using it and sending offenders to the timeout bin for 24h.

thanks for calling me "most uninformed" though.

[ Parent | on HN ]

Re:Tosh: Changing your SSH server's listen address every 30 ... by walrus01 on Sunday May 23, 2021 @05:46PM (#27258888)

I wasn't calling you most uninformed, your statement is totally correct, I was referring to any persons who might argue that fail2ban is purely useless as security theater. What I said was that fail2ban is useful as an annoyance/log clutter reducer, but not something that's an actual security measure which would be suitable to protect a poorly-configured sshd.

[ Parent | on HN ]

Re:Tosh: Changing your SSH server's listen address every 30 ... by behringer on Saturday May 22, 2021 @11:19PM (#27252141)

Fail2ban is also useful if you do leave something misconfigured. Mistakes happen so having a little redundancy is OK.

[ Parent | on HN ]

Re:Tosh: Changing your SSH server's listen address every 30 ... by tptacek on Saturday May 22, 2021 @11:21PM (#27252151)

Apply your redundancy to whatever is generating and safeguarding your SSH configurations.

[ Parent | on HN ]

Re:Tosh: Changing your SSH server's listen address every 30 ... by behringer on Sunday May 23, 2021 @07:32AM (#27254256)

What does this even mean? I'm the one who generates the ssh configuration for my computer clubs server...

[ Parent | on HN ]