Hacker News Reader

No, it's just the third server of a set, a leased dedicated bare metal CentOS server in a large data center in Phoenix AZ. No "cloud" service is involved.

This has been going on for about three weeks now. I may configure PAM to force a login delay; the logs are getting big.

View on HN

While it doesn't give any real security, changing the ssh port will at least filter out these kinds of attacks.

Would you consider fail2ban in this case?

"Warning: Using an IP blacklist will stop trivial attacks but it relies on an additional daemon and successful logging (the partition containing /var can become full, especially if an attacker is pounding on the server). Additionally, if the attacker knows your IP address, they can send packets with a spoofed source header and get you locked out of the server. SSH keys provide an elegant solution to the problem of brute forcing without these problems."

source: https://wiki.archlinux.org/index.php/Fail2ban

> Additionally, if the attacker knows your IP address, they can send packets with a spoofed source header and get you locked out of the server.

No they can't. That is not how TCP works.

From memory, you can spoof UDP but not TCP.

https://serverfault.com/a/153619/91708

Reply on news.ycombinator.com