mkdevops-se / mkdevops-se/hq.mkdevops.se
Prevent evil bots on the web from hacking the server
Nobody has claimed this yet.
- Dominant language
- Jinja
- Stars
- 1
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Description
I just logged in to the server, a 4-5 days since last time around, and what do I find..?
[me@hq ~]$ sudo su -
[sudo] password for me:
Last login: Tue Jan 5 13:46:18 CET 2021 on pts/0
Last failed login: Sat Jan 9 11:10:05 CET 2021 from 106.12.107.252 on ssh:notty
There were 52366 failed login attempts since the last successful login.
[root@hq ~]# df -h
/.../
Over 50 k failed login attempts to root account in less than a week.
Can we please add some software to keep track of these bots and forbid them from touching our server?
(And what does everyone else use? "Audit-to-allow" or whatever it's called?)
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files, tests, or entry points. Start by reviewing the repository's Ansible bootstrapping and clarifying which protection software and access policy are wanted; done should mean the selected protection is deployed and the reported SSH brute-force behavior is addressed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ansible
- Domain
- devops, infrastructure, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100