nub audit — tclip

Layer	Status	Details
Router SSH (direct)	🟢 Clean	No external failed attempts hitting the router itself. Only LAN/WireGuard SSH allowed in via firewall.
Firewall rules	🟢 Solid	Default-drop input/forward policies, only specific ports open. IPv6 also well-locked-down.
SSH rate-limiting	🟢 Active	nftables drops WAN SSH attempts exceeding 5/min per IP. Currently tracking offenders in the rate-limit set.
ACPI BIOS errors	🟡 Harmless	Just firmware bugs on the N5105 at boot — no security impact.
Key-based auth only	🟢 Good	No password prompts needed (sudo via passwordless config is LAN-only and command-restricted).

⚠️ The Concerning — What I Found

🚨 Major: 221,795 failed SSH login attempts since May 31

The router forwards WAN port 22 to miniserv (10.0.23.3), and miniserv is getting absolutely hammered:

Top attacking IPs (all from Poland, likely a botnet): | IP | Attempts | Origin | |:--:|:--------:|:------| | 87.251.64.149 | 23,983 🇵🇱 Poland (ISAEV Igor) | | 87.251.64.145 | 6,750 🇵🇱 | | 87.251.64.144 | 4,815 🇵🇱 — also caught in rate-limit set | | 87.251.64.147 | 3,960 🇵🇱 | | Others | Various EU IPs, ~1k each |

Usernames being tried: root, admin, test2, oracle, lighthouse, 123456, pi, splunk, debian, deployer, minecraft... full dictionary attack.

Just today (last ~4 hours): 2,381 attempts — this is actively ongoing right now.

🔓 Two issues on miniserv:

No fail2ban installed ❌ — The router's rate-limit (5/min/IP) helps, but attackers rotate IPs to stay under the threshold.
PasswordAuthentication is still default (yes) — The #PasswordAuthentication yes in sshd_config is commented out, meaning it inherits the default: enabled. Only KbdInteractiveAuthentication no is explicitly set, which blocks keyboard-interactive but not standard password auth.

📈 Other Observations

10.0.23.6 (behoserver) → router: Two preauth SSH connection closes on May 31 & Jun 1. No auth failure, just connections closed. Unclear if it's a script or a transient scan — worth investigating.
3 external IPs in router's rate-limit set right now: 45.194.67.148 (🇧🇷 Brazil), 85.111.68.99 (🇹🇷 Türkiye), 87.251.64.144 (🇵🇱 Poland) — still actively being throttled.

🛠️ Recommended Actions

On miniserv: sudo apt install fail2ban — this would dynamically ban IPs after a few failed attempts.
Set PasswordAuthentication no in /etc/ssh/sshd_config on miniserv — since you only use SSH keys, there's no reason to allow password logins.
Consider tightening the router's SSH rate-limit — 5/min per IP is generous. Could drop to 3/min with burst 3.
That 10.0.23.6 preauth connection might be nothing, but worth checking if something on behoserver is accidentally probing the router.

📋 nub audit

🔍 Security Audit Summary — behorouter & Network

✅ The Good — What's Working Well

⚠️ The Concerning — What I Found

🚨 Major: 221,795 failed SSH login attempts since May 31

🔓 Two issues on miniserv:

📈 Other Observations

🛠️ Recommended Actions