Hit 500 blocked login attempts on my home server this month

I set up a small home server for file sharing back in February, and I decided to check the SSH logs last night. Turns out I had over 500 failed login attempts just from this month alone. Most of them were bots from random IPs trying common usernames like admin and root. It really drove home why you need to disable password auth and use key-only access. Has anyone else gotten numbers like that from a setup that isn't even public facing?

2 comments

Log in to join the discussion

Log In

2 Comments

blairm442mo ago

Ha, 500? Those are rookie numbers, man. I hit that in like two days on a tiny VPS I barely use. But honestly, I kinda disagree with the panic over it. Its just the background noise of the internet. Bots scan everything, even non-public facing stuff will get hit if your IP leaks out once. The real point is that 500 failed attempts means your password auth is still on, and thats the actual problem. Disable that, use keys only, and the number of attempts literally stops mattering because they cant get in anyway. I leave SSH on port 22 for fun and just watch the logs, its free entertainment knowing theyre all wasting their time.

6

kevin_sullivan2mo ago

Same with locked doors in my neighborhood... people just try handles. @blairm44 nailed it.

3