Brute force SSH, what to do?

Question

SSH

Brute-force on SSH is constantly going on, I'm not afraid of the password, but the Internet on the VPS often falls off. The difficulty lies in the fact that they constantly brute force from different ip and different ports. What's the best way to stop this?

Answer 1

Install fail2ban ?
Change port?
Set up port knocking?

Answer 2

1. Use a firewall ;
   
2. Change the port on which the SSH server is running. From the 22nd to some 3184th ;
   
3. Use SSH keys instead of passwords.
   

Answer 3

Deny all but IP address 1.2.3.4 TCP connection on port 22
PS - eth1 is the address of your network card, it may not match yours.

Answer 4

If your “Internet falls off on VPS” precisely because of brute force, ddos ​​also arrives there, and here the VPS settings will not help in any way, since the brute clogs the channel to the server. Alternatively, you can try putting www.cloudflare.com in front of your VPS, I don’t know if they still have a free plan.

Answer 5

everyone has such garbage,
1) disable all web resources such as ssh, ftp, etc
2) use a program to configure,
3) put access on the web face only from LAN, for example, specifying 192.168.1.0 only the local subnet
4) port knoking
also roll and advice above
p.s. after I set access to everything only from LAN, they began to climb into the vpn tunnel :)
because only one port to the Internet is open ....

Answer 6

For this, I set up denyhost for myself, made a key for ssh access, I enter only by key, and disabled access to ssh with a password, and in denyhost I registered that anyone who knocks at least once with a password in ssh will be banned. I monitored for a week who was breaking, when the list exceeded 300 ip, then I stopped monitoring, it just works by itself.
And this is taking into account the fact that the server is private and only I know about it, there is not even a web muzzle, just for the service.