[acatton]

Another security article recommending fail2ban again... Please don't do this.

Run SSH behind some layer. Some people use Wireguard, and that's okay, I prefer spiped [1] because I can run it as an unprivileged user in a fully hardened systemd unit [2], and I can use ProxyCommand in my ssh_config, which makes it transparent: no need to be constantly on a VPN or to turn it on, I just ssh.

This guide recommends two-factor authentication, which IMHO is overkill and lowers your server reliability by using some random pam authentication modules. Also your spiped key (or your wireguard key) can be considered a second factor authentication.

And a second independent layer lowers the probability of being vulnerable to a 0-day vulnerability on SSH [3] or to Jia Tan [4]

fail2ban means you have a daemon running as root parsing random logs and modify your firewall rules... Yikes... [5] If you're concerned about bruteforce bots, they'll go away as soon as SSH behind something. Also with that layer, you don't need to make you firewall dynamic.

[1] https://www.tarsnap.com/spiped.html

[2] https://ruderich.org/simon/notes/systemd-service-hardening

[3] https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion....

[4] https://en.wikipedia.org/wiki/XZ_Utils_backdoor

[5] Yes I know, you can use as a user, and modify the firewall rules with custom script with an SUID. But nobody does this, actually this guide doesn't do this at all, just everything as root!

[eptcyka]

Jia Tan already has her code running on your machine, no second layer of auth will help that.

Spipe/vpn makes it so you cannot just connect via any machine, which sometimes is not helpful.