This bot waits 2.7 minutes between guesses
Real login attempts against an exposed server, spaced roughly 160 seconds apart. Slow enough that fail2ban's default of five retries in ten minutes never fires, so the attempts continue unnoticed.
This bot is patient. One password every 2.7 minutes.
I put a server online this morning and logged every login attempt. The first contact came after twelve minutes. What arrived after that was not a flood. It was a slow, steady trickle, and that is the part most setups get wrong.
Eight attempts, every single one as root, walking a predictable wordlist. Look at the timestamps: roughly one hundred and sixty seconds between guesses, every time. That spacing is deliberate. The default here is five failures within ten minutes before an address gets banned. At this pace only four ever land inside that window, so the counter resets before it fires and the attempts keep coming.
A slow attack is not a harmless one. It is an attack tuned to your threshold. Widen the window, or the guessing simply continues below it.
Check your findtime, not just your maxretry.
#linux#security#ssh#fail2ban#sysadmin
❯ Check your findtime, not just your maxretry.