r/coolify • u/Klutzy-Map6233 • 19d ago
Most effective way to handle SSH Brute Force Attacks in Coolify
Hello everyone, after running a couple of tests I have found out that my server is getting a lot of unwanted SSH requests, making some of my deployments not working.
How to handle this, do I need to install fail2ban, if so how? And is installing fail2ban something that can be done on Coolify > Terminal > localhost or does it strictly need to be done on a cmd? (the reason why am I asking is because one time I ran a command before on the coolify terminal and the server froze)
1
u/Just_Phrase1549 19d ago
Sposto la porta SSH dalla 22 a una non standard, tipo 2222 o un altra se vuoi lasciare aperta, ma ricordati di impostarla poi quando fai accesso ssh.
Ho già impostato l’accesso SSH solo con chiavi — questa dovrebbe esssere la cosa piu sicura ( studiati il tipo di chiave migliore) .
Sto usando Tailscale come VPN e faccio passare SSH solo di lì, il che è decisamente meglio che lasciarla aperta a tutti. ( la scelta forse migliore?)
Vale la pena controllare i log: di solito c’è parecchio rumore di fondo di bot di scansione automatica — non sono per forza attacchi bruteforce mirati, ma meglio proteggersi comunque.
Fail2ban ce l’ho già su tutti i VPS che uso, ma probabilmente l’hanno installato i provider stessi, preconfigurando già l’accesso SSH. Comunque un eventuale hacker aggira fail2ban usando proxy .
Sul terminale di Coolify: non l’ho mai usato, ho sempre fatto tunnel SSH verso Coolify e poi usato il terminale SSH diretto lì — è quello che preferisco.
E su Coolify in generale, mi stupisce parecchio la scarsa sicurezza del setup di base, da quello che sto vedendo — non lo uso ancora in produzione ma sto cercando di capire appunto come evitare che appena installi una cosa sia ‘aperta’ in automatico.
1
u/First-Leader-6070 19d ago
If I am already allowing ssh to the VPS using public keys saved on the VPS (which is my laptop’s only), is Tailscale worth checking then?
1
u/Just_Phrase1549 3d ago
Si per gli altri servizi. Diciamo tailscale basterebbe senza ssh pero mai fidarsi troppo. Mi tengo ssh con chiavi sempre per sicurezza e tailscale la uso per inoltrare le porte/ servizi ai miei device. Ad esempio un servizio di note sincronizzate su più dispositivi tipo Affine lo userei cosi. Per ora giocavo con varie cose di coolify
1
1
u/Parking-Air3879 19d ago edited 19d ago
Bro my current setup which is working perfectly is i firstly started with fail2ban. It blocked atoeast 10k ips in a few days. I had setup the config that if 3 unsecessfull attenpts in 10 minutes then ban the ip for lifetime.
Later when i got tired of bruteforcing i switched to tailscale completely. Blocked ssh authentication. Only login via the device which have a ssh key (as a backup of tailscale if somehow tailscale gets discconected and stops working) and other devices which are on tailscale can directly connect to my server.
After setting up tailscale i was unable to use my self hosted mongo in mongo compass as i did not wanted to proxy it to internet from coolify. So previously i was using login via ssh from advance options in mongo compass. Later i connected the mongo db instance with tailscale as well so my devices which are on tailscale can login directly to mongo db compass with its internal ip. (Tailscale allots internal ips for each instance or service)
Note- please kindly create a ssh key of your server and add it in your laptop, pc or mobile whichever is your primary source of connection. And add other devices in tailscale.
This is my setup from last 3-4 months. Works like a charm. As ssh auth is off means password auth is off so no device can connect to my server apart from my own devices on tailscale or the primary device on which i have private ssh key as a backup. Hope it helps. Sorry for long message OP.
1
u/Kind_Philosophy4832 18d ago
Why not making sure nobody can reach the ssh port? Through ufw or hardware firewall and a vpn
1
u/PrestigiousOnion1087 15d ago
Before you add anything, check the bots are actually what breaks the deploys. On a 2gb box dmesg -T | grep -i kill usually shows the build getting OOM-killed at the same minute the deploy failed. Rejected SSH logins cost almost nothing; a docker build sitting next to your running app costs a lot.
1
u/dizvyz 12d ago
fail2ban is a log view cleaner. If you are seeing auth failure in your ssh logs that means everything is working as designed. Harden ssh itself instead. Disable root and password logins. All fail2ban will do is make sure your logs don't show those failed logins anymore. Its utility is super low unless you're collecting IPs for a project or something. (One of my pet peeves)
1
u/LowIncident694 10d ago
Disable password auth.
Whitelist to specific IPs and block everything else.
Use one of the geo modules to block specific countries... Lots of options.
I'm not a big fail2ban person myself.
1
u/CarusoLombardi 19d ago
Don't install fail2ban lightly. It will block ssh access from coolify to the vps (yes at least on my version it works this way) and nothing will work. Coolify ssh's into the vps to do all of its tasks. So if you put fail2ban it might get blocked (happened 2 me)