Patch to Log SSH Passwords – One Year Results

Re:Patch to Log SSH Passwords – One Year Results by SixSigma on Thursday November 20, 2014 @08:03AM (#8635495)

Obscurity is a perfectly legitimate and valid security technique.

Relying on obscurity alone is the mistake you are alluding to.

Why wouldn't you recommend using fail2ban and changing the port?

[ Parent | on HN ]

Re:Patch to Log SSH Passwords – One Year Results by joshavant on Friday November 21, 2014 @02:11AM (#8640171)

>Relying on obscurity alone is the mistake you are alluding to.

Ok, sure.

>Why wouldn't you recommend using fail2ban and changing the port?

IMO, changing the port will have nearly the same overall effect as f2b: minimizing the number of failed password attempts from unknown users.

To that end, changing the port is changing one value in a config file, which has the attractive advantage of being far simpler to setup + maintain.

[ Parent | on HN ]

Re:Patch to Log SSH Passwords – One Year Results by SixSigma on Friday November 21, 2014 @01:22PM (#8642502)

I can confirm that changing the port does drastically reduce login attempts but also that it is not to zero, I had 45 yesterday, for instance but here's the kicker - all from the same IP.

Setup and maintenance are virtually zero though, for f2b. I know, I just installed it.

A one liner to install on most systems and updates along with everything else when your package manager does the updates.

[ Parent | on HN ]