This is getting out of hand
I know that security is something to take seriously, and I often try to do my best at keeping things safe. Are there things I could do better, sure. But even the most minimal setup can sometimes spare you a lot of headache down the road.
One of the best things you can do after setting up a Linux server is install and configure fail2ban.
I recommend at least turning on the ssh filter, in your jail.local
[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 192.168.1.1/24
bantime = 1h
bantime.increment = true
bantime.factor = 2
findtime = 10m
maxretry = 3
[sshd]
enabled = true
Give them 3 tries to login and ban them for an hour, then exponentially double it if they keep at it.
Also don't forget to enable any other services you might have open as well, the sample that comes with fail2ban has a good number of services you can turn on.
Turn it on:
sudo systemctl enable fail2ban.service --now
Who's doing this?
I'm pretty sure a lot of it is botnets, I've seen almost that entire IP block in my logs at one time or another.
Does anyone find this kind of thing useful?
I'll do more of these simple P.S.A. if people seem interested. I'm still trying to find my footing on writing. I just happened to be doing my daily stuff and saw that log and thought it was a bit much. I can't even imagine what my logs would look like if I didn't turn that stuff on.
