News for hackers. Stuff that matters.

A comment on What You Get After Running an SSH Honeypot for 30 Days. Parent comment

Re:What You Get After Running an SSH Honeypot for 30 Days by WhackyIdeas on Sunday June 16, 2024 @06:23AM (#40695984)
For SSH, changing to a random port number resulted in zero connection attempts from bots for months on end. It seems bots just never bother scanning the full 65535 port range.
[ Parent | on HN ]
Re:What You Get After Running an SSH Honeypot for 30 Days by dizhn on Sunday June 16, 2024 @06:37AM (#40696043)
For most of my VMs there's no ssh running. I use wireguard to connect to a private IP. I haven't done this on the bare metal yet but I might. Though barring exploits like we had recently nobody is getting into a server with either strong passwords or certificates. Fail2ban in my eyes is a log cleaner. It's not useful for much else.
[ Parent | on HN ]
Re:What You Get After Running an SSH Honeypot for 30 Days by cranberryturkey on Sunday June 16, 2024 @08:40AM (#40696620)
it bans the bad ips, isn't that worth running?
[ Parent | on HN ]
Re:What You Get After Running an SSH Honeypot for 30 Days by thfuran on Sunday June 16, 2024 @01:41PM (#40698761)
But what does that actually accomplish?
[ Parent | on HN ]
Re:What You Get After Running an SSH Honeypot for 30 Days by cranberryturkey on Monday June 17, 2024 @09:28PM (#40713170)
stops the attack from happening from those ips?
[ Parent | on HN ]
Re:What You Get After Running an SSH Honeypot for 30 Days by account42 on Monday June 17, 2024 @07:45AM (#40704609)
> the full 65535 port range

Note that putting SSH on a high port has security implications.

[ Parent | on HN ]
Re:What You Get After Running an SSH Honeypot for 30 Days by WhackyIdeas on Tuesday June 18, 2024 @08:44AM (#40717162)
What security implications?
[ Parent | on HN ]