Patch to Log SSH Passwords – One Year Results

Re:Patch to Log SSH Passwords – One Year Results by xtrumanx on Thursday November 20, 2014 @01:07AM (#8634624)

Wow you're right. I just setup my own VPS yesterday. Decided to check the auth logs and the first invalid user attempt occurred less than 3 hours from my first login.

The "POSSIBLE BREAK-IN ATTEMPT!" message worried me for a bit but a little googling and the fact I've disabled password login calmed me down.

Presumably, changing my sshd port will drastically reduce these attempts right? Or do attackers routinely port scan servers?

[ Parent | on HN ]

Re:Patch to Log SSH Passwords – One Year Results by wglb on Thursday November 20, 2014 @04:16PM (#8638190)

Yes, most of the time i use a different port than 22 and the noise all but dissapears.

Mind you it isn't that this is a defense, but it gets the drive-by scanning stuff out of the log.

By all means disable password login, and all direct root login.

[ Parent | on HN ]

Re:Patch to Log SSH Passwords – One Year Results by untrothy on Thursday November 20, 2014 @02:33AM (#8634714)

I changed my port from 22 to a higher one and the user attempts are completely gone.

Only nuisance is that the higher ports may be blocked, for example my uni blocks my new ssh port so I can't connect to the vps when I'm on campus.

[ Parent | on HN ]

Re:Patch to Log SSH Passwords – One Year Results by cheese1756 on Thursday November 20, 2014 @02:47AM (#8634745)

If you don't host any https websites on the VPS, using 443 will almost always get past port blocking.

[ Parent | on HN ]

Re:Patch to Log SSH Passwords – One Year Results by btgeekboy on Thursday November 20, 2014 @03:46AM (#8634872)

Or just use both :) https://dgl.cx/2010/01/haproxy-ssh-and-ssl-on-same-port

[ Parent | on HN ]

Re:Patch to Log SSH Passwords – One Year Results by lshevtsov on Thursday November 20, 2014 @07:02AM (#8635314)

Another choice is port 8080.

[ Parent | on HN ]