my ec2 (ubuntu-20.04) instnace having abusive attack in an intermittent manner

Question

few days back my instance have got an abusive attack, I have taken security measures, but this time again it happend. also i don't know how automatically ssh-key removed from authorized_key file, and another key have taken place, each time my instance showing "server key refused" when trying to ssh into it using putty.

any help will be appreciated.

Rodney Lester · Answer

A security best practice is to limit the CIDR that you can access port 22 on. See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/authorizing-access-to-an-instance.html

Alternatively, and current best practice, you can use Systems Manager Session Manager, where access is managed through IAM: https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html

my ec2 (ubuntu-20.04) instnace having abusive attack in an intermittent manner

Add your answer

Relevant content