Hacker News Reader

Comment by oofabz | Hacker News Reader

I always install fail2ban so to prevent brute force ssh attacks from getting in. It's popular enough that's it's probably available in your distro's package repositories.

http://www.fail2ban.org/

View on HN

Also, don't use SSH passwords. Authenticate only with SSH keys.

An SSH private key is almost impossible to brute force, compared to passwords. (unless your SSH key generator has been patched by a clueless Debian maintainer)

Funny tidbit. I spun up a DO box (luckily it wasn't too important) to do some tasks on.

I set the root password (over ssh) to something random but only 8 characters. I meant to change it to use only keys, of course, but the machine was compromised in under an hour!

Better yet: it's a workstation. There's a pretty solid chance you don't actually need sshd to be even running.

(Granted, this guide specifies that it's meant for sysadmins managing groups of workstations, in which case SSH access might be necessary for remote administration, but for most users, SSHing into a workstation is unnecessary.)

Alternatively, use SSHguard if you want/need IPv6 support.

http://www.sshguard.net/

https://github.com/fail2ban/fail2ban/issues/1123

Why would you have sshd running on your workstation in the first place?

I've ssh'd into colleagues' machines to help them with system problems, and they've ssh'd into mine to retrieve their VPN keys. Not all of my colleagues have ssh access to a common server somewhere.

I've also remoted into my workstation from home to do emergency work.

Ideally, those colleagues would keep sshd disabled unless they actually do need your remote assistance, at which point they'd "service sshd start" or "systemctl sshd.service start" (or however it's normally done with systemd) or "/etc/init.d/ssh start" or "/etc/rc.d/rc.ssh start" or what have you. Minimization of attack surface is an important part of a comprehensive security strategy, and a remote login system - even one with a phenomenal track record like OpenSSH - contributes pretty heavily to that attack surface.

It's irreplacable when one occasionally works from home.

So that you can ssh to it?

To allow remote management tools to run. If there's one thing that'll make your systems insecure, it's letting everyone manage their own boxes.

SSHd allows you to restrict particular users to IP ranges and of course you can use IP tables and fail2ban too.

Reply on news.ycombinator.com