I wanted to know what efficient way is there to handle malicious attempts to connect to my server by single IPs. The attempts show up logged in /var/log/auth.log
as Connection closed by IPaddress port XXX [preauth]
.
Additional info about sshd_config
:
- Password login is disabled
MaxAuthTries 3
PubkeyAuthentication yes
PasswordAuthentication no
PermitEmptyPasswords no
DenyUsers pi admin ubuntu
The question's first part is: should I even bother to block these attempts?
There is a different IP attempting a single connection every few seconds. I can handle the ones that try to login multiple times I think, but the sheer number of single connection attempts seems to be a bit of a pain in the neck.
One condition would be that I don't want to whitelist only certain IPs for ssh connection to the server.
Now if I should block these attempts, I'd love to have some suggestions about how to handle that (apart from fail2ban please).
Server Use:
The server is used in two ways:
- I run scripts on it that don't necessitate internet connection (basically I'm just offloading the work that I could do on a local machine to the server to run in 24/7) - i.e.: Data Analysis scripts
- I run some scripts that actually use internet connection. These connections are made to some APIs, but can also involve scraping websites.
What I intend to clarify about this is that, there is no website/API/etc hosted on this server, so connections should really not be made to it.
That is connections except for me. I usually connect through the terminal to edit files that is : scp
or ssh
connections.
Why not whitelist my IP? I travel a bit, or at least move around, so it would be a bit too difficult to add all the IPs, keep track of them etc. (Or knowing them in advance could be impossible or too burdensome.)