I usually just disable password auth and update regularly, when I have an SSH server open to the internet.
Short of an 0day in the SSH service, I expect brute forcing the private key(s) to take longer than I have years to live.
Short of an 0day in the SSH service, I expect brute forcing the private key(s) to take longer than I have years to live.
This had an unintended effect... most of my automated HTTP(s) attacks stopped as well-- presumably because the IPs of compromised machines were already blocked.
fail2ban is the first thing install. It’s also easy to understand, which I love. It’s basically regex on log files.
Most distros those days come with journald, and to best of my awareness journald does not have per-unit (or better, per unit per message type) configurable retention.
Still in the TODO list today: https://github.com/systemd/systemd/blob/908dbc70d6abeb9f6562... (since at least 2016), with corresponding issue gathering no traction: https://github.com/systemd/systemd/issues/9519