Hacker News Reader

I simply run fail2ban with a whole bunch of customer filters that will ban people very quickly. There's no need to request php or malformed urls when php is not used for example.

I used to run fail2ban, but I found it (or at least its defaults) ineffective against discouraging further requests. With iptables, you can specify the connection to hang for a period and then drop

Defaults are set to reject. Just configure the jails or a global config.

A iptables hashlimit rule can do the same. Your firewall rules get to be more readable and you don't end up relying on the security of a log parser.

The biggest win comes from just disabling password authentication in sshd though.

I run endlessh, I always giggle when I see some connection that last for 2d

a lot of ppl thought this would be a good idea at some point

upaste link is 404