[WhackyIdeas]

For SSH, changing to a random port number resulted in zero connection attempts from bots for months on end. It seems bots just never bother scanning the full 65535 port range.

[dizhn]

For most of my VMs there's no ssh running. I use wireguard to connect to a private IP. I haven't done this on the bare metal yet but I might. Though barring exploits like we had recently nobody is getting into a server with either strong passwords or certificates. Fail2ban in my eyes is a log cleaner. It's not useful for much else.

[cranberryturkey]

it bans the bad ips, isn't that worth running?

[thfuran]

But what does that actually accomplish?

[cranberryturkey]

stops the attack from happening from those ips?

[account42]

> the full 65535 port range

Note that putting SSH on a high port has security implications.

[WhackyIdeas]

What security implications?