Hacker News new | ask | show | jobs
by hackermom 5223 days ago
Oy... Just shove your sshd off to another port already!
2 comments

Even better, just use iptables to drop any connection that is outside of a certain ip range or your static ip or your domain name. It will eliminate all of those attacks and port scanning won't help them. It doesn't mean someone can't get in, but it will eliminate the script kiddies.
I have a script (easy when one embeds Lua inside syslogd) that checks for failed ssh logins and after a few failed attempts, blocks the address via iptables (and another script to remove such blocks after a few hours to keep iptables entries from piling up).
That's essentially what DenyHosts[1] and fail2ban[2] do, except they're more complex (the former has blacklist sharing, while the later supports more than ssh).

[1]: http://denyhosts.sourceforge.net/index.html

[2]: http://www.fail2ban.org/wiki/index.php/Main_Page

Running SSH on a different port is not a solution, it helps yes.

You're making assumptions about this video, did you ever think the whole point might be to collate these kind of attacks? =)

It effectively solves the problem of random carpet-bombing, but obviously not the problem of planned attacks. No, it never struck me as being done solely to draw up statistics of the subject, as it has been done a million times already.
Then don't waste your time commenting on it?