Hacker News Reader

Comment by Someone1234 | Hacker News Reader

Why do people install fail2ban then disable password based authentication entirely? I legitimately don't understand the purpose.

Also, they complain about log spam (from failed SSH attempts) this is one reason to move SSH to a different port. It does NOT increase security, but it DOES reduce log spam from bots trying for easy targets.

View on HN

Fail2ban can be used to block IPs based on any log file, not just SSH - I believe the author uses an Apache log in the example.

It also has rules for mailers, and other utilities, which I often use just because they're nice and simple to work with.

I always change the ssh port to something other than 22. It has always seemed to work well for me for most automated attacks. Perhaps this is not advisable for some reason?

There is a slight security concern to binding it to a port above 1024 in that a non-privileged user can bind to that port and MITM.

Here is a good summary of the different options you have with ssh and choosing a port:

http://serverfault.com/questions/619898/should-i-change-the-...

From experience, running ssh on non-default port have mostly reduced automated login attempts to 0, year after year.

fail2ban installed = less logspam, and never having to adjust default port with whatever tool is ssh'ing

moving ssh port = less logspam, but now you have to specify your ssh port in every tool that uses it, and it's one more thing that other staff have to remember

Have you tried it both ways? some scripted attacks will try 22 find that it is open then spam it with attacks. If it's not open they will have to scan your ports then spam you with attacks

Reply on news.ycombinator.com