So it’s my first time setting up a VPS. Is it to be expected to ban 54 IPs over a 12h timespan? The real question for me is whether this is normal or too much.

$ sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 3
|  |- Total failed:     586
|  `- Journal matches:  _SYSTEMD_UNIT=ssh.service + _COMM=sshd
`- Actions
   |- Currently banned: 51
   |- Total banned:     54
   `- Banned IP list:   [list of IPs]

fail2ban sshd.conf

$ sudo cat /etc/fail2ban/jail.d/sshd.conf 
[sshd]
enabled = true
mode = aggressive
port = ssh
backend = systemd
maxretry = 3
findtime = 600
bantime = 86400

I have disabled SSH login via password. And only allow it over an SSH key.

$ sudo sshd -T | grep -E -i 'ChallengeResponseAuthentication|PasswordAuthentication|UsePAM|PermitRootLogin'
usepam no
permitrootlogin no
passwordauthentication no
  • bizdelnick@lemmy.mlEnglish
    7·
    5 hours ago

    Yes, it is normal.

    # fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 10
|  |- Total failed:     4433
|  `- Journal matches:  _SYSTEMD_UNIT=ssh.service + _COMM=sshd
`- Actions
   |- Currently banned: 27
   |- Total banned:     668
   `- Banned IP list:   2.57.122.194 45.148.10.183 195.178.110.30 2.57.122.208 92.118.39.195 103.74.123.88 92.118.39.23 2.57.122.196 92.118.39.197 45.148.10.151 92.118.39.236 178.20.210.185 68.178.161.186 80.94.92.183 92.118.39.63 2.57.122.197 2.57.122.191 2.57.122.189 80.94.92.171 94.156.152.18 14.225.7.70 45.78.198.199 211.253.9.160 159.224.213.138 1.214.42.172 103.239.165.114 77.239.111.233