Loading…
15
Can we talk about hitting 47 failed login alerts in a single day and what I should do next?
So I set up fail2ban on my home server about a month ago, mostly for SSH, and last Friday I woke up to 47 alerts in my inbox. I checked and it was all from one IP in Romania trying to guess my username and password over and over. The scary part is I recognized the username they were trying because it was an old default account I forgot to delete. I changed everything and banned the IP, but now I am wondering if I should just move SSH to a different port or go full key only. What would you do in this case?
1 comments
Log in to join the discussion
Log In1 Comment
drew_thomas91mo ago
Why move the port when key only would actually fix the problem?
3