So it’s my first time setting up a VPS. Is it to be expected to ban 54 IPs over a 12h timespan? The real question for me is whether this is normal or too much.

$ sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 3
|  |- Total failed:     586
|  `- Journal matches:  _SYSTEMD_UNIT=ssh.service + _COMM=sshd
`- Actions
   |- Currently banned: 51
   |- Total banned:     54
   `- Banned IP list:   [list of IPs]

fail2ban sshd.conf

$ sudo cat /etc/fail2ban/jail.d/sshd.conf 
[sshd]
enabled = true
mode = aggressive
port = ssh
backend = systemd
maxretry = 3
findtime = 600
bantime = 86400

I have disabled SSH login via password. And only allow it over an SSH key.

$ sudo sshd -T | grep -E -i 'ChallengeResponseAuthentication|PasswordAuthentication|UsePAM|PermitRootLogin'
usepam no
permitrootlogin no
passwordauthentication no
  • pHr34kY@lemmy.worldEnglish
    91·
    15 hours ago

    They’re portscanning bots.

    I made SSH IPv6-only and it stopped. You can’t scan IPv6 space for open ports.

        • pHr34kY@lemmy.worldEnglish
          8·
          6 hours ago

          The smallest possible subnet has 18.4 quintillion addresses.

          You can’t scan it before encountering the heat death of the universe.

          Outgoing connections are made on a different address that does not accept incoming connections. You never disclose your real IP when browsing.

          So, no. It can’t be done.