#fail2ban — Public Fediverse posts

#proxmox #lxc #debian #docker #nginx #fail2ban

BlablaLinux @[email protected] · 2026-05-27 · 19:50 UTC

#proxmox #lxc #debian #docker #nginx #fail2ban

BlablaLinux @[email protected] · 2026-05-27 · 19:50 UTC

#fail2ban #nginx #docker #debian #lxc #proxmox

BlablaLinux @[email protected] · 2026-05-27 · 19:50 UTC

https://mastodon.highteq.net/@pulsar/116647474314685634

#proxmox #lxc #debian #docker #nginx #fail2ban

Brian Swetland @[email protected] · 2026-05-27 · 16:11 UTC

Is there an easy way to setup fail2ban to instaban any ssh connection attempts not using a public key?

Yes, I have "PasswordAuthentication no" in sshd.conf.

No, I do not want to instantly ban *all* failures, just failures where no publickey was provided.

And thank you, @pulsar for actually answering my question:

#fail2ban #questions #linux

🐈‍⬛David Sommerseth @[email protected] · 2026-05-25 · 21:24 UTC

I always remap my sshd daemon to listen to a non-standard port, to reduce a lot of noise. Which has worked fine for years. But every now and then there are attempts. All the #Linux kernel flaws found lately has made remote login attempts more interesting for attackers. And they scan much more broadly now than just port 22.

And that's why my second line of defence is to disallow remote root login - and also make use of the AllowGroups feature in sshd_config. Users granted remote access must be member of a specific group. And root is also excluded from this group.

That pays off these days. And this is a nice filter match for #fail2ban and similar tools

I have 293 login attempts on "random users" since May 21. And 259 attempts as root.

#sshd #systemhardening #kernel #linux #fail2ban #infosec

🐈‍⬛David Sommerseth @[email protected] · 2026-05-25 · 21:24 UTC

I always remap my sshd daemon to listen to a non-standard port, to reduce a lot of noise. Which has worked fine for years. But every now and then there are attempts. All the #Linux kernel flaws found lately has made remote login attempts more interesting for attackers. And they scan much more broadly now than just port 22.

And that's why my second line of defence is to disallow remote root login - and also make use of the AllowGroups feature in sshd_config. Users granted remote access must be member of a specific group. And root is also excluded from this group.

That pays off these days. And this is a nice filter match for #fail2ban and similar tools

I have 293 login attempts on "random users" since May 21. And 259 attempts as root.

#linux #fail2ban #infosec #ssh #sshd #systemhardening

🐈‍⬛David Sommerseth @[email protected] · 2026-05-25 · 21:24 UTC

I always remap my sshd daemon to listen to a non-standard port, to reduce a lot of noise. Which has worked fine for years. But every now and then there are attempts. All the #Linux kernel flaws found lately has made remote login attempts more interesting for attackers. And they scan much more broadly now than just port 22.

And that's why my second line of defence is to disallow remote root login - and also make use of the AllowGroups feature in sshd_config. Users granted remote access must be member of a specific group. And root is also excluded from this group.

That pays off these days. And this is a nice filter match for #fail2ban and similar tools

I have 293 login attempts on "random users" since May 21. And 259 attempts as root.

#linux #fail2ban #infosec #ssh #sshd #systemhardening

🐈‍⬛David Sommerseth @[email protected] · 2026-05-25 · 21:24 UTC

I always remap my sshd daemon to listen to a non-standard port, to reduce a lot of noise. Which has worked fine for years. But every now and then there are attempts. All the #Linux kernel flaws found lately has made remote login attempts more interesting for attackers. And they scan much more broadly now than just port 22.

And that's why my second line of defence is to disallow remote root login - and also make use of the AllowGroups feature in sshd_config. Users granted remote access must be member of a specific group. And root is also excluded from this group.

That pays off these days. And this is a nice filter match for #fail2ban and similar tools

I have 293 login attempts on "random users" since May 21. And 259 attempts as root.

#kernel #systemhardening #sshd #ssh #infosec #fail2ban

🐈‍⬛David Sommerseth @[email protected] · 2026-05-25 · 21:24 UTC

I always remap my sshd daemon to listen to a non-standard port, to reduce a lot of noise. Which has worked fine for years. But every now and then there are attempts. All the #Linux kernel flaws found lately has made remote login attempts more interesting for attackers. And they scan much more broadly now than just port 22.

And that's why my second line of defence is to disallow remote root login - and also make use of the AllowGroups feature in sshd_config. Users granted remote access must be member of a specific group. And root is also excluded from this group.

That pays off these days. And this is a nice filter match for #fail2ban and similar tools

I have 293 login attempts on "random users" since May 21. And 259 attempts as root.