Hello,
Via the diagnosis tool I got this warning - a suspiciously high number of authentication failures. My SSH port is already custom. Has someone an idea on what is wrong or how to investigate it?
Hope so and thanks in advance.
It’s surprising that they now try with non-standard ports, but it’s a good thing Fail2Ban catches on and blocks them.
You do not have much to do actually, there is nothing wrong with this situation: any server opened on the internet is bound to be probed like that.
If you want to take an additional step, you could:
- make sure to disable password login and only use SSH keys, that will make very difficult to guess your credentials
- I took one of the IPs and checked it online: it’s already flagged as a bad actor. You can install the nftables-blacklist app if you want to be proactive with the known bad IPs. I have tried on my server with this app, and that IP is in the general blocklist you can enable after installation.
Il y a un post sur le forum comme quoi une personne avait eu quelques soucis en bloquant un peu trop.
Un guide/tuto aurait été bien pour ne pas se retrouver bloqué.
Hey thanks for your warning.
In my case I leave it like it is for now.
Kind regards!
Thanks for your reply. For now I leave it like it is.
Kind regards!
@JfmbLinux, the thread has an English tag, please respect that. 
The app has a clear warning about blocking too much and is asking for feedback to build a general allowlist to avoid such inconveniences. Additionally it adds the server’s own IP address to the allowlist, it is still unclear what actually happened in the issue described in the thread.