Goodbye SSH Brute-force!

Skip to main content

Hashnode Cyber Defender's Musing

Cyber Defender's Musing

Portfolio

Command Palette

Search for a command to run...

Goodbye SSH Brute-force!

UpdatedOctober 19, 2020

•1 min read•View as Markdown

Goodbye SSH Brute-force!

Principal Research & Translation Specialist at ST Engineering Info-Security Pte Ltd

On this page

TL;DR Why?Reduce Attack-Surface Improve "Signal-to-Noise" Ratio Storage is Precious

Comments (1)

Join the discussion

Jym Cheong5y ago

Extra fun, put this: https://github.com/skeeto/endlessh on the standard port... It keeps SSH clients locked up for hours or even days at a time.

More from this blog

How to add Google Analytics & submit Hashnode blog for indexing?

Why bother? I wrote four entries related to Cyber Deception, submitted March 2021, yet none are found on Google with the exact title search. Instead, the Cyber-Observatory & Hackernoon versions (same titles & contents) came out on Google-search first...

Mar 1, 2022·4 min read·717

How to add Google Analytics & submit Hashnode blog for indexing?

A Systematic Approach to Cyber Deception (Part 4 of 4)

Recap Part 1 introduced three phases of Cyber Deception Campaign & highlighted 4 considerations related to Industrial Networks: (1) Safety, (2) Availability, (3) Realism, & depending on our strategic goals, (4) Secrecy that we should be mindful thro...

Apr 27, 2021·7 min read·197

A Systematic Approach to Cyber Deception (Part 4 of 4)

A Systematic Approach to Cyber Deception (Part 3 of 4)

Recap Part 2 of this series touched on planning & measuring success of a Cyber Deception campaign. It also covered some "estimations" of Threat Actors based on Operational Security abilities. This part will illustrate more examples of simulation vs d...

Mar 23, 2021·5 min read·297

A Systematic Approach to Cyber Deception (Part 3 of 4)

A Systematic Approach to Cyber Deception (Part 2 of 4)

Recap Part 1 introduced 3 Phases of Cyber Deception Campaign. We briefly highlighted 4 considerations related to Industrial networks: (1) Safety, (2) Availability, (3) Realism, & depending on our strategic goals, (4) Secrecy that we should be mindfu...

Mar 11, 2021·4 min read·273

A Systematic Approach to Cyber Deception (Part 2 of 4)

A Systematic Approach to Cyber Deception (Part 1 of 4)

Introduction This series is about Knowing ourselves, our enemy & plan in a way to conjure "grounds" & "weather" to our advantage. This approach is adapted from a joint-paper by Mohammed H. Almeshekah and Eugene H. Spafford, published by Springer ...

Mar 9, 2021·2 min read·318

A Systematic Approach to Cyber Deception (Part 1 of 4)

Cyber Defender's Musing

7 posts

Technologist specialising in Cyber Defense

TL;DR

Sign-up https://zerotier.com, free for the 1st 50 devices!
Create a Zerotier private network
Join private network, both ssh-server & client
Configure sshd to listen with private IP
Goodbye ssh-brute-force!

Why?

Reduce Attack-Surface

Screenshot 2020-10-16 at 8.57.43 AM.png

When we disrupt one or more of the Necessary & Sufficient conditions for any Cyber-Physical attacks, in this case Threat Accessibility, we lower the risk ( probability). This applies to other administrative service/ports.

Even if there were a 0-day ssh-server vulnerability that is exploitable, attackers will need to first get into your client.

Enabling Multi-Factor/Step Authentication on your VPS provider is also related to Threat Accessibility.

Improve "Signal-to-Noise" Ratio

Server-logs are useful for investigating any incidents. When cluttered with blocked/refused SSH attempts, those entries are simply "noise", which will be eliminated after this configuration.

Storage is Precious

Why waste it on "noise"?

343 views

© 2026 Cyber Defender's Musing

Archive
Privacy
Terms