In the past two weeks I set up a new VPS, and I run a small experiment. I share the results for those who are curious.
Consider that this is a backup server only, meaning that there is no outgoing traffic unless a backup is actually to be recovered, or as we will see, because of sshd.
I initially left the standard “port 22 open to the world” for 4-5 days, I then moved sshd to a different port (still open to the whole world), and finally I closed everything and turned on tailscale. You find a visualization of the resulting egress traffic in the image. Different colors are different areas of the world. Ignore the orange spikes which were my own ssh connections to set up stuff.
Main points:
-
there were about 10 Mb of egress per day due just to sshd answering to scanners. Not to mention the cluttering of access logs.
-
moving to a non standard port is reasonably sufficient to avoid traffic and log cluttering even without IP restrictions
-
Tailscale causes a bit of traffic, negligible of course, but continuous.
Well your rules will depend on what services are actually running on the host. For a basic setup I recommend just configuring /etc/fail2ban/fail2ban.local, /etc/fail2ban/jail.local and /etc/fail2ban/jail.d/sshd.conf.
You will also want to harden sshd configuration.
From there, every time you add a new service with an authentication mechanism, setup a corresponding fail2ban jail/filter to check the logs for auth failures. Here are a few examples: gitea jail and filter, jellyfin jail and filter, nextcloud jail and filter.
Fail2ban comes with pre-made filters for common services, just enable the relevant jails from
jail.local. If you need to write custom jails/filters, make sure to check that your filters work against actual log messages usingfail2ban-regex