Spent 2 days chasing a brute force attack - one simple rule fixed it

Had someone trying to get into my SSH server about 3 weeks ago. Tried fail2ban, changed ports, even locked down keys only. Still saw failed attempts filling up logs. Then a buddy said "just rate limit the connections at the firewall level." Set a simple 3 attempts per minute rule on the router and it killed 99% of the noise. Anybody else found that blocking at the network edge works better than app level stuff?

2 comments

2 Comments

alice80824d ago

Nah, app level blocking gives me more control over who gets through.

rose_henderson23d ago

In my experience, app level blocking like @alice808 mentioned can be useful for fine tuning, but it often misses attacks that hit multiple services through the same IP. Had a situation where a guy was probing both SSH and a web app from the same source, and fail2ban only caught one service at a time. Setting a strict connection limit at the router cut off everything at once without me having to configure five different apps. Plus, it saves CPU cycles on the server since the firewall handles the heavy lifting before anything even hits the application layer. Your mileage may vary depending on your setup, but for me, network edge blocking simplified the whole mess dramatically.