Tosh: Changing your SSH server's listen address every 30 seconds based on TOTP

Re:Tosh: Changing your SSH server's listen address every 30 ... by tgv on Sunday May 23, 2021 @02:45AM (#27252924)

I had inherited a server (Arch linux) which ran something like fail2ban (can't remember what it's called). It slowed down the machine tremendously, because the iptables lists became very big, and every packet started taking up too much CPU. I had to disable it (switching to whitelisting instead). Did you ever encounter something like this with fail2ban?

[ Parent | on HN ]

Re:Tosh: Changing your SSH server's listen address every 30 ... by mercora on Sunday May 23, 2021 @03:21AM (#27253045)

at a previous job i cleaned up after such mess. they used to have fail2ban adding thousands of rules without ever deleting them automatically. I replaced it with a pam module that maintained an ipset for addresses with failed login attempts.

[ Parent | on HN ]

Re:Tosh: Changing your SSH server's listen address every 30 ... by _wldu on Sunday May 23, 2021 @11:03AM (#27255445)

ipset is very efficient.

[ Parent | on HN ]