• ozymandias117@lemmy.worldEnglish
      4·
      2 个月前

      I set up, and prefer, iptables rules to rate limit logins.

      I have mine set so you can connect up to 5 times per 15 minutes.

      Blocks bots well enough, and if I really mess up, I just wait 15 mins

    • smiletolerantly@awful.systems
      2·
      2 个月前

      The nice thing about SSH key-based access is, I either have the key and login succeeds, or I have no business trying to log in.

      That’s why my remote root server bans via fail2ban after a single failed login.

      Yes I’ve had to write support to get a KVM. Yes it’s still configured like this.

      • baguettefish@discuss.tchncs.deEnglish
        3·
        2 个月前

        i am a tailscale enjoyer, which means i can set up tailscale ssh once on each machine and then from another machine just login over tailscale

          • glibg10b@lemmy.zip
            1·
            2 个月前

            With Tailscale, you don’t have to open your SSH port to the whole internet. It’s actually kind of silly that many servers are still exposing ports for private services on the internet

          • baguettefish@discuss.tchncs.deEnglish
            1·
            2 个月前

            you can disable the need for a password or key if you like, and you also don’t really need fail2ban, since nothing is actually port forwarded anywhere

      • probablymissing@lemmy.world
        0·
        2 个月前

        as a nixos enjoyer, i have no idea how to setup ssh keys. fail2ban and a regular password for me.

        yes, i have locked myself out of my own server for hours at a time because i’m an absolute tool.

        • smiletolerantly@awful.systems
          4·
          2 个月前

          Ehm… I’m also on Nixos and I’d say it’s super trivial.

          services.openssh = {
  enable = true;
  settings = {
    PasswordAuthentication = false;
    PermitRootLogin = "no";
  };
};

users.users.<name>.openssh.authorizedKeys.keys = [ list of pubkeys ideally read from file in repo ];
          • Urist@lemmy.mlEnglish
            2·
            2 个月前

            So easy it should be illegal! I mean, how can we feel superior if we are not wasting huge amounts of time setting things up!?

            • smiletolerantly@awful.systems
              3·
              2 个月前

              I mean, how can we feel superior if we are not wasting huge amounts of time setting things up!?

              Why, by boasting that it’s so easy, just look at that, it is only two options you need to set thanks to the 80 custom modules I’ve written to abstract the abstractions from nixpkgs!

              I WISH I could put an /s here, but I cannot.