Background: 15 years of experience in software and apparently spoiled because it was already set up correctly.

Been practicing doing my own servers, published a test site and 24 hours later, root was compromised.

Rolled back to the backup before I made it public and now I have a security checklist.

  • DefederateLemmyMl@feddit.nl
    link
    fedilink
    arrow-up
    4
    ·
    9 hours ago

    If it is your single purpose to create a blocklist of suspect IP addresses, I guess this could be a honeypot strategy.

    If it’s to secure your own servers, you’re only playing whack-a-mole using this method. For every IP you block, ten more will pop up.

    Instead of blacklisting, it’s better to whitelist the IP addresses or ranges that have a legitimate reason to connect to your server, or alternatively use someting like geoip firewall rules to limit the scope of your exposure.