Hacker News Reader

Back in August of 2023, I would gets *hundreds* of SSH login attempts per minute. Looking at my logs, the numbers have dropping precipitously ever since.

As of this month, I only received 17 attempts. All from the same IP range.

Can't say I can complain about this.

View on HN

Moving from 22 to a nonstandard port did miracles to avoid this.

Really think port knocking could help thwart this entire category of attacks too.

I run ssh on an overlay network so it is never directly exposed to the internet and it is nice to not have to worry about changing ports, fail2ban, knocking. Of course you don't get to do fun analytics on the bots though.

Im using a non standard port in the 40,000 range. Changing the port won't necessarily stop the traffic. A lot of these bot nets will portscan an entire ip of anything that has port 80 open to find non standard ports.

It is much more expensive to port scan against UDP than TCP so a nonstandard UDP port would be a lot safer again. OpenVPN is one of the only services that let you do that though.

I'm pretty sure you can put Wireguard on any UDP port you desire, too.

Reply on news.ycombinator.com