News for hackers. Stuff that matters.

A comment on How I spend my first 5 minutes on a server.

Re:How I spend my first 5 minutes on a server by cdjk on Sunday March 03, 2013 @09:50PM (#5316296)
I've never understood the point of fail2ban if you disable ssh password authentication. Yeah, it might eliminate some spam in the logs, but if you only allow key-based authentication that doesn't really matter.
[ Parent | on HN ]
Re:How I spend my first 5 minutes on a server by MichaelGG on Sunday March 03, 2013 @10:04PM (#5316332)
fail2ban can deal with much more than SSH login attempts. I believe you can configure it to do arbitrary actions on arbitrary log events. Perhaps it comes with a block for HTTP, too?

Seeing as he blocks SSH and only allows it from his IP, there won't be any SSH attempts reaching sshd at all, so fail2ban wouldn't be doing anything if it was looking at SSH only.

[ Parent | on HN ]
Re:How I spend my first 5 minutes on a server by denrober on Sunday March 03, 2013 @10:00PM (#5316320)
My only thought is even with password auth. turned off hostile persons can still connect to the ssh daemon and might discover and unknown vulnerability or some type of dos. If you know someone is trouble why let them in even if you are wearing armor?
[ Parent | on HN ]
Re:How I spend my first 5 minutes on a server by numbsafari on Sunday March 03, 2013 @10:04PM (#5316329)
It'd really suck if they could forge traffic from you that looked like a failed login attempt and that resulted in you getting banned.
[ Parent | on HN ]
Re:How I spend my first 5 minutes on a server by anderiv on Sunday March 03, 2013 @10:17PM (#5316371)
That is why fail2ban allows you to configure a whitelisted IP (your office, VPN, etc.) that will never get banned.
[ Parent | on HN ]
Re:How I spend my first 5 minutes on a server by petejansson on Sunday March 03, 2013 @10:18PM (#5316375)
Keys can be brute-forced.
[ Parent | on HN ]
Re:How I spend my first 5 minutes on a server by cdjk on Sunday March 03, 2013 @10:28PM (#5316406)
That is way down on my list of things to worry about.
[ Parent | on HN ]
Re:How I spend my first 5 minutes on a server by dchest on Monday March 04, 2013 @03:53AM (#5317340)
No.
[ Parent | on HN ]
Re:How I spend my first 5 minutes on a server by drivebyacct2 on Monday March 04, 2013 @03:57AM (#5317348)
Pretty much, not to be a jerk but it's a bit alarming from someone claiming to do security consulting.
[ Parent | on HN ]
Re:How I spend my first 5 minutes on a server by mh- on Monday March 04, 2013 @01:24PM (#5319615)
uh..
[ Parent | on HN ]
Re:How I spend my first 5 minutes on a server by drivebyacct2 on Sunday March 03, 2013 @11:38PM (#5316643)
Breaking into the server warehouse and stealing data drives seems far, far, far more of a security threat.
[ Parent | on HN ]