Who's Attacking My Server?

Re:Who's Attacking My Server? by mrjin on Sunday March 13, 2022 @09:03PM (#30667423)

IPs on the log files most likely are exit proxies if those attackers were not rookies. Simply change the SSH port only would deter 90% of those attempts per my personal experience.

[ Parent | on HN ]

Re:Who's Attacking My Server? by walrus01 on Sunday March 13, 2022 @11:46PM (#30668330)

while I'm not the greatest fan of fail2ban ever, though I do use it on some public facing servers, it also has the option for "recidivism" which means that an IP that repeatedly gets itself banned will be banned for an even longer duration, which at least cuts down on the log file clutter somewhat.

[ Parent | on HN ]

Re:Who's Attacking My Server? by mrjin on Monday March 14, 2022 @12:48AM (#30668617)

You were right about it. I'm currently not using fail2ban and I probably should start using it. Those login failures are nuisance.

[ Parent | on HN ]