So it's my first time setting up a VPS. Is it to be expected to ban 54 IPs over a 12h timespan? The real question for me is whether this is normal or too much.

$ sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 3
|  |- Total failed:     586
|  `- Journal matches:  _SYSTEMD_UNIT=ssh.service + _COMM=sshd
`- Actions
   |- Currently banned: 51
   |- Total banned:     54
   `- Banned IP list:   [list of IPs]

fail2ban sshd.conf

$ sudo cat /etc/fail2ban/jail.d/sshd.conf 
[sshd]
enabled = true
mode = aggressive
port = ssh
backend = systemd
maxretry = 3
findtime = 600
bantime = 86400

I have disabled SSH login via password. And only allow it over an SSH key.

$ sudo sshd -T | grep -E -i 'ChallengeResponseAuthentication|PasswordAuthentication|UsePAM|PermitRootLogin'
usepam no
permitrootlogin no
passwordauthentication no
you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 6 months ago (3 children)

My SSH is only accessible thru a self hosted WireGuard VPN with a dedicated IP. Zero fails.

  • source
  • hideshow 3 child comments
  • [–] 3 points 6 months ago (2 children)

    How do you deal with the risk of loosing the VPN (and thus the access)?

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 6 months ago

    The VPN SSH rule is configured at provision level firewall which I can access through HTTPS and temporarily change the whitelisted IP addresses. Never have done this, though. WireGuard is very stable and it is also behind another firewall.

  • source
  • parent