When I have disabled SSH password authentication, so we can only login using private key authentication, is there still a point in having fail2ban running for SSH brute force protection?

I'm thinking that either the attacker has the key, or they haven’t. So what protection is actually offered?


I would still use it regardless, even though you are correct in saying that using SSH key authentication it’s highly unlikely to brute force.

There would be a little more overhead if someone is trying to brute force your SSH server compared to being denied directly by IPTables.

Personally, I change the default port, to something > 10000 and therefore I never see any connections that I don't recognise.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.