Comment on What else should I do for my home server security?
foggy@lemmy.world 14 hours ago
Use authelia for 2fa
Disable root ssh
Disable password authentication for ssh.
Set up Fail2ban
That’s about all that’s left; 2fa and brute force protection. Good job.
And move SSH to a non-default port. Without that, my public-facing servers get thousands of SSH attacks a day, and it basically goes to zero after moving it to a random-looking high port.
Also, totally agree with using public key login and disable password login.
That’s generally good advice but not actually security related.
Removing all the stress on your ressources by using a non-standard port is good for your ressources, But those automated scanners looking for unsecured devices and trying out password like admin/admin are not actually a risk. It’s just a case of security by obscurity and never actually serves its purpose.
Very true. There are only ~65K ports. If someone decides they want to, trying all of them to see which one gives a valid response is trivial.
Literally a single nmap command will tell me where you “hid” your ssh port.
Like the poster you’re responding to said, it is good advice but not for security. It takes you off the hacker spam list, essentially.
OpenSSH rate limits authentication attempts so it isn’t a big deal.
moldy_rice@piefed.keyboardvagabond.com 2 hours ago
Sub fail2ban for wazuh. It does the same but so much more, and does everything with 0 config after fresh install.