Hi, On Wed, Jul 05, 2023 at 05:24:27AM +0000, Vito.V wrote: > When I run logwatch Why do I get ? Bye Bye [preauth] : 2484 Times ?
It's a particular SSH app/library that disconnects with that string. The client can put its own message there. > there are around 3000 connections to SSH per day. Is this amount normal ? Yes. Bad actors scan for SSH and use username/password combinations all day every day. They will fairly quickly find your sshd even if you put it on a non-standard port. > Is this something to be concerned about? Yes, if you have to enable password-based authentication. If not then you can ignore it. You seem to have password-based authentication disabled so that's fine. Even so, it can get to the point where your MaxStartups is exhausted which prevents legitimate connections. If that starts to become a problem for you then you may still need to play with that setting, and also things like Fail2Ban, firewall rate limiting of connections (TCP SYN) or maybe even VPN technology. Cheers, Andy -- https://bitfolk.com/ -- No-nonsense VPS hosting
