Hacker News new | ask | show | jobs
by davrosthedalek 2459 days ago
I always switch my outward-facing ssh servers to key-only. Is there any advantage for running fail2ban additionally?
3 comments

Presumably then iptables handles the reject/drop rather than SSH sessions being created that fail at login? (Disclaimer, I don't know exactly how any sshd handles dropping clients who attempt to connect by password when you have set it to cert only; but it seems like dropping at the firewall would be more optimal).
It makes your logs easier to read because they aren't full of ssh failures.
for my DO droplet I also changed the ssh port to a silly-high random port and the last time I checked it reduced the amount of nosy bots knocking at the door to zero.
I used to do so too, but sometimes had problems with very restrictive firewalls killing connections to high/unknown ports when traveling. They would only allow vpns or ssh to connect.