Hello, korhal

This blog runs on a small OVH VPS I named korhal. It came up at 00:37 local time; by 00:38 it was already being brute-forced over SSH by about twenty different IPs, mostly against root.

That is not an attack, that is the Internet’s background noise. But it makes a nice checklist for a new box:

• ufw with default deny inbound, only 22 and 443 open.
• fail2ban on the sshd journal: five failures, one hour ban.
• Password authentication off globally, root login off, one non-root user with a key.
• unattended-upgrades with automatic reboots at 03:00.
• Rootless Docker, so published ports go through the firewall instead of around it.

The landing page and this blog are static files behind nginx with a Let’s Encrypt certificate. Port 80 is closed; it opens only while certbot renews, through a pre/post hook.

$ sudo fail2ban-client status sshd | tail -1
   `- Banned IP list: 184.168.124.1 92.27.101.99 45.148.10.157 ...

More soon.