Hit 100,000 blocked login attempts on my home server this morning

Been running a little Pi-hole and fail2ban setup for about 5 years now. The counter just rolled over and I had to double check it. That's basically someone trying to break in every 26 minutes on average. Makes me wonder how many of those were actually automated bots vs some guy in his basement trying common passwords.

2 comments

2 Comments

sullivan.piper1d ago

You ever read that one study where they set up a honeypot server with default passwords and it got compromised in under 2 minutes? I saw that somewhere on a security blog a while back and it blew my mind how fast these bots work. Moving SSH to a nonstandard port is honestly one of those things that works way better than people give it credit for, cuts out all the noisy script kiddie scans.

joel_young6d ago

That "every 26 minutes" stat really puts it in perspective. I moved my SSH to a nonstandard port years ago and it dropped my failed login attempts by about 90% overnight. Sometimes the simple stuff works better than you'd expect.