/etc/logrotate.d/authsize 10Mrotate 3Port knocking in 2009 needed kernel patches or userspace pcap. Now it's in repos everywhere but the fundamental tradeoff hasn't changed: security through obscurity plus inconvenience.
Member
Sshguard is good! I forget this. The python of fail2ban is problem for me, very slow start. In Argentina the connection to update repos is sometimes bad, and fail2ban need many dependencies.
I use now only iptables + knockd in HostHatch. But sshguard maybe better for client who no want complexity of knocking. I will test.
Our nephew looked at sshguard. He said still needs read logs, still needs run something. The iptables rule runs once and done. For bakery server this is enough, we only ssh maybe twice a month when LocalTech needs fix something.
I asked about log size, he said he set logrotate already. Problem solved before it start.
Port knocking I tried, got locked out twice because mobile IP changed mid-knock. Never again.
Member
I run a 96MB box in Riga, OpenVZ from some dead provider I got for $4/year. No iptables recent module available, kernel too old. I use denyhosts, remember that? Python 2, barely maintained, but it works. Parses auth.log, writes to hosts.deny.
Tcp_wrappers still functions on this ancient template. Richard7 would approve.
Member
The 128MB cases I tell them to use CloudFlare tunnel or not host there.
Member
Nonstandard port cuts bot traffic by 99% without any software. I track this myself, logs to my own InfluxDB. Port 22 gets thousands of attempts daily. Port 4422 gets maybe ten, all targeted not spray-and-pray.
Memory cost: zero. Security gain: marginal but noise reduction massive. I bill hourly in pesos, every MB of RAM saved is money.
Still use iptables rate limit on top, because targeted scans exist. Layered, cheap, good enough.
What about ufw with limit? It generates similar iptables rules but easier syntax.
ufw limit 22/tcpNot for 128MB probably, but for 512MB+ it's manageable and you get IPv6 rules too.
ufw statusI just learned
iptables-saveiptables-restore/etc/iptables/rules.v4