Choose your own adventure
You are browsing the web and this comes up:
What do you want to do:
1. Activate
2. Look at the location bar
3. Click [Cancel] or [X]. I don't have time for this!
4. Click "Don't show this again"! IT will update later
Fail2ban with VYOS API
Introduction I, like many people, found that I was getting a few failed ssh attempts per day. I looked at a root account facing the internet and found a little over 32000 failed attempts per day. Rest assured, these are low-skill attacks with a pretty low risk of compromise, but still, there are a few things that still makes me want to respond to it. Firstly, it's a lot of noise in the logs. It fills disks and makes it hard to see more dangerous attacks. Second, this confirms malicious intent. Maybe it's just a compromised box that is now part of a botnet, but you never know if it's going to be a platform for another attack. Finally, even though it's a low probability of compromise, there is still a chance. I know most of these attacks are checking for things like 10-year-old linksys WAPs with default passwords, but there is also the worst case out there, distributed brute force attacks and password spraying. My decision was to block this traffic, but then the next ques...
Comments
Post a Comment