Hacker News Reader

Comment by zimbatm | Hacker News Reader

If you use fail2ban make sure to pin the right key to the right host. Otherwise ssh will try all the keys and get you banned from your own host. The easiest way is to use the ~/.ssh/config:

    Host myhost
      IdentityFile ~/.ssh/myhost

View on HN

Good advise. This happenned to me. By luck I had another account I could use to recover. I wish I could disable that feature. I use config now but the default should not be to try every key in ssh directory.

Agreed. That seems like a weakness in OpenSSH. One should have to turn on a "try all keys" option to get that behaviour ..

Yeah, it's on by default. See IdentitiesOnly to turn it off.

It still may try other identity files. You need the IdentitiesOnly option, I believe.

I've been bitten by this a few times.

You should do this even if you're not using fail2ban. Otherwise any box you connect to can enumerate all of your public keys, which could be a problem for some people.

I don't think doing this actually prevents that. Your full agent is still forwarded. You need to use a separate agent per key if you want to prevent the remote host from using your other keys.

If you're using key based auth exclusively, you don't need fail2ban.

fail2ban is for any log you want to monitor and block access to your machine for; not just ssh. fail2ban isn't a "keep my logs clean" tool it's a "reduce my attack surface" tool.

Edit: Feel free to Google "fail2ban security" if you disagree.

Also, low values of the sshd option "MaxAuthTries" makes having multiple keys annoying. There are servers I have to log into with "1" or "2". It's really annoying and doesn't enhance security, especially with "PasswordAuthentication no".

Reply on news.ycombinator.com