Hacker News Reader

If your ISP and the server support IPv6, just disable SSH on IPv4.

Some of my servers don't even have any IPv4 connectivity and there haven't been any failed SSH logins over IPv6.

My OpenSSH is located on a non standard port, 22/tcp is going to the endlessh honeypot.

Not to disappoint you, but except for logging SSH honeypots are becoming useless (most bots automatically disconnect when they detect a long login banner).

So should I add a long banner to my server to disguise it as a honey pot, just in case?

I mean, I'm not sure that you can do that with OpenSSH though (short of recompiling it, which I do not recommend unless you're a company).

> endlessh honeypot.

*tarpit

A honeypot lets people "in" to see/research malware that's in the wild:

* https://en.wikipedia.org/wiki/Honeypot_(computing)

A tarpit just takes up the attacker's resources:

* https://en.wikipedia.org/wiki/Tarpit_(networking)

Not what most people run, but SSH honeypots are also useful:

https://lwn.net/Articles/848291/

I like this solution a lot!

Reply on news.ycombinator.com