Re: auth log full with

2022-08-14 Thread Matthias Böttcher
Am So., 14. Aug. 2022 um 16:42 Uhr schrieb Reco : > whois, geoiplookup, even https://bgp.he.net . > Whatever works, basically. > Last one is my favorite as it shows all IP blocks assigned to AS. > Really helpful with spammer nests such as outlook.com (AS8075) or > DigitalOcean (AS14061). > > > Is

Re: auth log full with

2022-08-14 Thread Lee
On 8/14/22, Matthias Böttcher wrote: > Am So., 14. Aug. 2022 um 09:51 Uhr schrieb Reco : > >> Personally I don't use fail2ban for sshd. Because why bother with >> userspace (written in python too, yuck) if the kernel does the same job? >> I.e. block M$ AS, China Telecom AS and maybe add Eastern Eur

Re: auth log full with

2022-08-14 Thread Joe
On Sun, 14 Aug 2022 16:07:03 +0200 Matthias Böttcher wrote: > Am So., 14. Aug. 2022 um 09:51 Uhr schrieb Reco > : > > > Personally I don't use fail2ban for sshd. Because why bother with > > userspace (written in python too, yuck) if the kernel does the same > > job? I.e. block M$ AS, China Telec

Re: auth log full with

2022-08-14 Thread Reco
Hi. On Sun, Aug 14, 2022 at 04:07:03PM +0200, Matthias Böttcher wrote: > how do I block these ip ranges? The usual way. iptables -I INPUT -s -p tcp --dport 22 \ -m conntrack --ctstate NEW -j DROP or, if the source IP is an actual IPv6 (a rare thing in my experience): ip6tables

Re: auth log full with

2022-08-14 Thread Matthias Böttcher
Am So., 14. Aug. 2022 um 09:51 Uhr schrieb Reco : > Personally I don't use fail2ban for sshd. Because why bother with > userspace (written in python too, yuck) if the kernel does the same job? > I.e. block M$ AS, China Telecom AS and maybe add Eastern Europe to the > mix, and you've just reduced t

Re: auth log full with

2022-08-14 Thread Reco
Hi. On Sun, Aug 14, 2022 at 09:16:25AM -0400, Stefan Monnier wrote: > > In fact, I'd restrict allowed SSH algorithms like this: > > > > Ciphers chacha20-poly1...@openssh.com,aes256-...@openssh.com > > MACs > > hmac-sha2-512-...@openssh.com,hmac-sha2-256-...@openssh.com,umac-128-...@

Re: auth log full with

2022-08-14 Thread Reco
Hi. On Sun, Aug 14, 2022 at 08:57:47AM +0200, Maurizio Caloro wrote: > Thanks for you answer, yes add aggressive to mode, restart services and add > to ssh_config > > Host * > HostKeyAlgorithms +ssh-rsa,ssh-dss > PubkeyAcceptedKeyTypes +ssh-rsa,ssh-dss Please do not do this unles

Re: auth log full with

2022-08-13 Thread Reco
Hi. On Sat, Aug 13, 2022 at 07:42:28PM +0200, Maurizio Caloro wrote: > how I can disable this?, I try solution with failban, but this want be > help!? > > [sshd] > Enable = true > Mode = normal As /etc/fail2ban/filter.d/sshd.conf shows, "no matching host key type" messages are specifi