[tor-relays] Many SSH requests

[William Kane]

Hi,

Only allow public key authentication (preferably avoiding RSA, DSA and
ECDSA keys and just going for an Ed25519 one), disabling root login
and then creating an unprivileged user to work on the machine which
will be added to the AllowUsers directive in sshd_config will make
brute-forcing obsolete.

You might still want to move the port from 22 to anything random from
1024-65535 to get rid of the frequent log entries caused by servers
scanning for outdated or vulnerable sshd instances.

- William

On 02/04/2021, Cristiano Kubiaki Gomes <cristianockg at gmail.com> wrote:
> Thank you all for the recommendation. It took some time but I think I am
> relatively safer now.
>
> And also learned a lot. Much appreciated.
>
> All the best!
>
> On Fri 2 Apr 2021 at 11:40, The Doctor [412/724/301/703/415/510] <
> drwho at virtadpt.net> wrote:
>
>> ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
>> On Wednesday, March 31, 2021 9:35 AM, Cristiano Kubiaki Gomes <
>> cristianockg at gmail.com> wrote:
>>
>> O noticed many ssh requests to my Debian VM running a Relay and I am
>> wondering if this is normal or if this is happening only with me.
>> Anyone else see this ssh attemptives? Is it normal?
>>
>>
>> Yup, it's background radiation on the Internet.  We all get them.
>>
>> If SSH key authentication only isn't enabled, turn it on.  Change the
>> port
>> sshd is listening on.
>> Set up fail2ban to further protect the new port (I get a lot of portscans
>> hammering my nodes
>> looking for the new sshd port followed by brute force attempts, so may as
>> well cut 'em off
>> at the knees).
>>
>> Or set up a hidden service for sshd on the box and reconfigure it to
>> listen on the loopback only.
>> You'll only be able to SSH in over the Tor network after that, but it'll
>> cut the login attempts way
>> down.
>>
>> The Doctor [412/724/301/703/415/510]
>> WWW: https://drwho.virtadpt.net/
>> The old world is dying, and the new world struggles to be born. Now is
>> the
>> time of monsters.
>>
>>
>> _______________________________________________
>> tor-relays mailing list
>> tor-relays at lists.torproject.org
>> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
>>
> --
> Cristiano Kubiaki
> Telegram <https://telegram.me/cris_kubiaki> | LinkedIn
> <https://www.linkedin.com/in/cristianokubiaki/> | Twitter
> <https://twitter.com/criskubiaki>
> ITIL - MCP - MCDST - MCTS - DCSE
>