I wanted to know what efficient way is there to handle malicious attempts to connect to my server by single IPs. The attempts show up logged in
Connection closed by IPaddress port XXX [preauth].
Additional info about
- Password login is disabled
DenyUsers pi admin ubuntu
The question's first part is: should I even bother to block these attempts?
There is a different IP attempting a single connection every few seconds. I can handle the ones that try to login multiple times I think, but the sheer number of single connection attempts seems to be a bit of a pain in the neck.
One condition would be that I don't want to whitelist only certain IPs for ssh connection to the server.
Now if I should block these attempts, I'd love to have some suggestions about how to handle that (apart from fail2ban please).
The server is used in two ways:
- I run scripts on it that don't necessitate internet connection (basically I'm just offloading the work that I could do on a local machine to the server to run in 24/7) - i.e.: Data Analysis scripts
- I run some scripts that actually use internet connection. These connections are made to some APIs, but can also involve scraping websites.
What I intend to clarify about this is that, there is no website/API/etc hosted on this server, so connections should really not be made to it.
That is connections except for me. I usually connect through the terminal to edit files that is :
Why not whitelist my IP? I travel a bit, or at least move around, so it would be a bit too difficult to add all the IPs, keep track of them etc. (Or knowing them in advance could be impossible or too burdensome.)