Efficiently handling malicious, single connection attempts to a server?

Question

I wanted to know what efficient way is there to handle malicious attempts to connect to my server by single IPs. The attempts show up logged in /var/log/auth.log as Connection closed by IPaddress port XXX [preauth].

Additional info about sshd_config:

• Password login is disabled
• MaxAuthTries 3
• PubkeyAuthentication yes
• PasswordAuthentication no
• PermitEmptyPasswords no
• DenyUsers pi admin ubuntu

The question's first part is: should I even bother to block these attempts?

There is a different IP attempting a single connection every few seconds. I can handle the ones that try to login multiple times I think, but the sheer number of single connection attempts seems to be a bit of a pain in the neck.

One condition would be that I don't want to whitelist only certain IPs for ssh connection to the server.

Now if I should block these attempts, I'd love to have some suggestions about how to handle that (apart from fail2ban please).

---

Server Use:

The server is used in two ways:

1. I run scripts on it that don't necessitate internet connection (basically I'm just offloading the work that I could do on a local machine to the server to run in 24/7) - i.e.: Data Analysis scripts
2. I run some scripts that actually use internet connection. These connections are made to some APIs, but can also involve scraping websites.

What I intend to clarify about this is that, there is no website/API/etc hosted on this server, so connections should really not be made to it. That is connections except for me. I usually connect through the terminal to edit files that is : scp or ssh connections.

Why not whitelist my IP? I travel a bit, or at least move around, so it would be a bit too difficult to add all the IPs, keep track of them etc. (Or knowing them in advance could be impossible or too burdensome.)

Answer 1

... should I even bother to block these attempts?

If you are sure that none of these attempts will ever succeed (for example because password based authentication is not allowed anyway, only key based is active) then it is not strictly necessary to block these. In the spirit of defense in depth it would be nice though to limit or even stop the attempts.

I'd love to have some suggestions about how to handle that

In general: everything you do to harden the access might impact your own usability and their is also some costs (time is money) associated with setting it up and maintaining it. So you need to find the personal balance between security measures and usability and costs. That said, here some suggestions:

• Limit the connection attempts per time to reduce how much connections SSH has to handle in the first place. This might slow down the attempts. See Limit max connections per IP address and new connections per second with iptables.
• Setup the SSH server on a non-standard port. The common scanners will focus on port 22 and will not check every possible port for an SSH server. It is still possible to additionally listen on the default port 22 but with a strict limit on connections per time to confuse scanners.
• Use something like port knocking to enable access to the port only after some secret port sequence was "touched". A similar concept is Single Packet Authorization where access to the SSH port is only enabled after some "magic" packet was send.
• One can explicitly blacklist certain IP addresses or ranges (like Tor exit nodes) or use a more generic blocking based on the geographic location of the sender.