On: Crowdsec: A Fail2Ban alternative written in Go

[ahendriksen]

For me definitely! I have a tiny VPS running ARM that I use as a build server. I get so much SSH spam that it noticeably slows down the VPS (both with and without Fail2Ban)..

"Written in Go" signifies to me that it can be faster and more resource-efficient than Fail2Ban: a good reason to check it out.

[InvaderFizz → ahendriksen]

Is this really much of a problem? I have a VPS that's been online for years, serving port 22. I average about 200k attempts per year. I have it set to pubkey only, root can't login at all. If you connect without sending a pubkey, it pretty much instantly tells you to go away. I don't bother with fail2ban.

Maybe I should start logging attempted pubkeys as a side project just to see what pops up.

[abdusco → ahendriksen]

You should consider changing default SSH port. It helps a lot with the spam.

[coolspot → abdusco]

Also adding port knocking.

https://netslovers.com/2018/02/28/port-knocking-server-secur...

[blibble → abdusco]

and/or add an iptables rule that limits the rate, set high enough such that you'll never hit it

1 line in your iptables config