News for hackers. Stuff that matters.

A comment on Sshole. Parent comment

Re:Sshole by traceroute66 on Thursday November 05, 2026 @09:15AM (#50379316)
> if you have Fail2Ban set up.

Worth noting that if you are running a remotely recent version of SSH it has everything you need built-in. No need for Fail2Ban on SSH these days.

[ Parent | on HN ]
Re:Sshole by Borealid on Friday November 06, 2026 @09:36AM (#50392813)
Could you maybe explain a bit more about how one sets up OpenSSH to block brute-force login attempts with only its built-in features?
[ Parent | on HN ]
Re:Sshole by traceroute66 on Friday November 06, 2026 @02:57PM (#50397535)
> Could you maybe explain a bit more about how one sets up OpenSSH to block brute-force login attempts with only its built-in features?

There are various ways, but you will probably want to start by investigating a combination of :

      - PerSourceMaxStartups
      - PerSourceNetBlockSize
      - PerSourcePenalties
      - Match Invalid-User + RefuseConnection
`PerSourcePenaltyExemptList` is also worth a mention if its the sort of thing you like, we don't use it at $work as whitelisting IP ranges is not really in-line with modern security best-practice (zero trust etc.).
[ Parent | on HN ]