Sub fail2ban for wazuh. It does the same but so much more, and does everything with 0 config after fresh install.
Comment on What else should I do for my home server security?
foggy@lemmy.world 3 weeks ago
Use authelia for 2fa
Disable root ssh
Disable password authentication for ssh.
Set up Fail2ban
That’s about all that’s left; 2fa and brute force protection. Good job.
moldy_rice@piefed.keyboardvagabond.com 3 weeks ago
Thaurin@lemmy.world 2 weeks ago
wazuh
Oh hey, thanks for that. I have eyed Sanfly before for filesystem drift detection mostly, but I don’t think they have a free tier (anymore?). Through researching this, I also ran into Lynis, which can perform health and compliance scans of your systems.
StateMachine@lemmy.zip 3 weeks ago
And move SSH to a non-default port. Without that, my public-facing servers get thousands of SSH attacks a day, and it basically goes to zero after moving it to a random-looking high port.
Also, totally agree with using public key login and disable password login.
Ooops@feddit.org 3 weeks ago
That’s generally good advice but not actually security related.
Removing all the stress on your ressources by using a non-standard port is good for your ressources, But those automated scanners looking for unsecured devices and trying out password like admin/admin are not actually a risk. It’s just a case of security by obscurity and never actually serves its purpose.
gastroglizzy@piefed.social 3 weeks ago
Very true. There are only ~65K ports. If someone decides they want to, trying all of them to see which one gives a valid response is trivial.
foggy@lemmy.world 3 weeks ago
Literally a single nmap command will tell me where you “hid” your ssh port.
Like the poster you’re responding to said, it is good advice but not for security. It takes you off the hacker spam list, essentially.
Thaurin@lemmy.world 2 weeks ago
Why do you expose port 22 to the entire internet? Limit it to your own IP addresses and/or only allow access through your Wireguard/VPN ranges. Then changing the default port becomes meaningless.
possiblylinux127@lemmy.zip 3 weeks ago
OpenSSH rate limits authentication attempts so it isn’t a big deal.