In the past two weeks I set up a new VPS, and I run a small experiment. I share the results for those who are curious.

Consider that this is a backup server only, meaning that there is no outgoing traffic unless a backup is actually to be recovered, or as we will see, because of sshd.

I initially left the standard “port 22 open to the world” for 4-5 days, I then moved sshd to a different port (still open to the whole world), and finally I closed everything and turned on tailscale. You find a visualization of the resulting egress traffic in the image. Different colors are different areas of the world. Ignore the orange spikes which were my own ssh connections to set up stuff.

Main points:

  • there were about 10 Mb of egress per day due just to sshd answering to scanners. Not to mention the cluttering of access logs.

  • moving to a non standard port is reasonably sufficient to avoid traffic and log cluttering even without IP restrictions

  • Tailscale causes a bit of traffic, negligible of course, but continuous.

  • James@lemmy.ca
    link
    fedilink
    English
    arrow-up
    78
    ·
    1 year ago

    Public key auth, and fail2ban on an extremely strict mode with scaling bantime works well enough for me to leave 22 open.

    Fail2ban will ban people for even checking if the port is open.

    • devtimi@lemmy.world
      link
      fedilink
      English
      arrow-up
      23
      ·
      1 year ago

      Honest question, is there a good default config available somewhere or is what apt install fail2ban does good to go? All the tutorials I’ve found have left it to the reader to configure their own rules.

      • Sleepkever@lemm.ee
        link
        fedilink
        English
        arrow-up
        6
        ·
        1 year ago

        Honestly the default config is good enough to prevent brute force attacks on ssh. Just installing it and forgetting about it is a definite option.

        I think the default block time is 10 minutes after 5 failed login attempts in 10 minutes. Not enough to ever be in your way but enough to fustrate any automated attacks. And it’s got default config for a ton of services by default. Check your /etc/fail2ban/jail.conf for an overview.

        I see that a recidive filter that bans repeat offenders for a week after 10 fail2ban bans in one day is also default now. So I’d say that the results are perfect unless you have some exotic or own service you need fail2ban for.

    • JubilantJaguar@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      arrow-down
      7
      ·
      1 year ago

      If Fail2Ban is so important, why the h*** does it not come installed and enabled as standard?!

      Security is the number-1 priority for any OS, and yet stock SSHD apparently does not have Fail2Ban-level security built in. My conclusion is that Fail2Ban cannot therefore be that vital.