I have an internet-facing Raspberry Pi on a private internet connection and the last time I set it up, I didn't bother installing a way of blocking IP addresses from which too many SSH login attempts failed from attempting SSH logins in the near future because I simply don't see the point of it.
All this resulted in is log entries looking like this:
2016-10-01 14:28:25 root failed 18.104.22.168:56388 2016-10-01 14:28:26 root failed 22.214.171.124:43921 2016-10-01 14:28:27 root failed 126.96.36.199:56388 2016-10-01 14:28:28 root failed 188.8.131.52:43921 2016-10-01 14:28:30 root failed 184.108.40.206:56388 2016-10-01 14:28:30 root failed 220.127.116.11:43921 2016-10-01 14:28:34 root failed 18.104.22.168:41379 2016-10-01 14:28:35 root failed 22.214.171.124:41379 2016-10-01 14:28:35 root failed 126.96.36.199:60430 2016-10-01 14:28:37 root failed 188.8.131.52:41379 2016-10-01 14:28:37 root failed 184.108.40.206:60430 2016-10-01 14:28:41 root failed 220.127.116.11:42230 2016-10-01 14:28:41 root failed 18.104.22.168:60430
The log only shows login attempts via password since attempting to log in via public key authentication would be even more ridiculous. The vast majority of login attempts tries to log in as
root which in the case of my raspi of course can't even log in at all. So far, no login attempts even guessed a valid user name (
pi has been guessed quite often but it doesn't exist on my raspi), let alone one which even can log in via username and password.
Is there any security benefit of blocking such IP addresses for a few minutes? The chance of a system with only complex passwords (for the users which can log in via username and password) seems to be basically 0. Even with only an 8 character printable ASCII password (which would be pathetic, of course), the username guaranteed to be correct (since one should never assume a username to be a secret), and 100 login attempts per second (which my slow internet connection probably can't even handle), that's literally ~1 million years until expected success.
If I block these login attempts, all I'm realistically going to do is to tell the attackers to go attack someone else and maybe lock myself out for a few minutes if I get a password wrong too often (happened only once thus far and I set the time to block to something like 2 minutes so I only had to wait for a short period of time). I don't see why this would be advised. It just seems so unnecessary. Am I missing something?