Hacker News Reader

Comment by pnutjam | Hacker News Reader

Don't forget fail2ban or something similar. 2 hour lockout after 4 bad tries does wonders to discourage bots.

I don't like it because it opens up the possibility of someone on the same network as me locking me out of my own server.

Sure, it's unlikely, but I don't see what I'd be gaining using fail2ban in the first place. I don't leave password authentication enabled, of course.

Log spam is a bit annoying, but at the end of the day, who cares? Even with the ongoing attempts, my authlog is like 300K uncompressed today and 60-120K per day gzipped. Whatever.

If I cared about that I would prefer to just block Chinese IP ranges outright.

If your passing through a NAT, you can whitelist your own IP.

something like: fail2ban-client set addignoreip x.x.x.x or fail2ban-client set addignoreregex hostname.com

Sure. But why? We're talking about 1MB to keep a week's worth of logs. It's just not worth even a minor hassle, or the most remote possibility of failure.

It's not about logs, it's about defense layers.

Well, if you use certificates, you can immediately ban anyone trying to do password authentication.

Just an obvious protip to test that your cert works before banning password auths. I uh, found out the hard way.

Yeah, cannot say I've never done that.

Test then Ban.

I never had an issue with authentication. My issue was a typo in sudoers (I allowed a user to view syslog, iirc, and had a semicolon instead of a colon) that prevented me from using sudo, as only my primary user was allowed to log in via ssh. Fortunately cloud vps still has vnc login, and I actually had a root password. Now I use a root shell to edit sudoers, so I can test it before dropping root.

You should use "visudo", which opens the file in the default editor, then validates it before saving.

if you edit outside of visudo, you can run visudo -cf <filename>.

example: visudo -cf /etc/sudoers visudoe -cf /etc/sudoers.d/extra

But make sure to change the default editor to something sane first. (* ducks *)

:q!dammitwtf

+1 to that!

I like nano, and I'm not ashamed to admit it.

True, but having supported an sftp server for other b2b clients to upload data, ssh keys are black magic to too many people. I can't count the hours I've spent trying to explain them, how to generate them and why you should never "show anyone your privates", just your publics.

It would be more obvious if the private key files were named “id_ed25519.private”.

Why not make it “identity.ed25519.private.sshkey” and default to “20200916{,T224400Z}.ed25519.{private,public}.sshkey”?

Put in a feature request to the openssh guys. Theo can probably tell you why it's not a good idea, or why it is good idea.

Reply on news.ycombinator.com