Comment by traceroute66
2 days ago
> if you have Fail2Ban set up.
Worth noting that if you are running a remotely recent version of SSH it has everything you need built-in. No need for Fail2Ban on SSH these days if your config is fully modernised.
2 days ago
> if you have Fail2Ban set up.
Worth noting that if you are running a remotely recent version of SSH it has everything you need built-in. No need for Fail2Ban on SSH these days if your config is fully modernised.
Could you maybe explain a bit more about how one sets up OpenSSH to block brute-force login attempts with only its built-in features?
> Could you maybe explain a bit more about how one sets up OpenSSH to block brute-force login attempts with only its built-in features?
There are various ways, but you will probably want to start by investigating a combination of the below tuned for your environment :
`PerSourcePenaltyExemptList` is also worth a mention if its the sort of thing you like, we don't use it at $work as whitelisting IP ranges is not really in-line with modern security best-practice (zero trust etc.).