UDM’s regular built in threat filtering, good firewall rules, updated services, and not opening up unnecessarily to the internet. And be vigilant but don’t worry too much about it. That’s it.

It’s really really cool. Excellent work.

Ha, yeah this is very common.

I’ve been constantly under attack from about ten times this for around 10 years.

They brute force common words and try various names as logins. It’s very primitive.

It waxes and wanes in frequency but averages to three or four per minute.

I have ssh on port 2222 (which btw they also figure out pretty quickly, I would recommend a less obvious alternative port) and fail2ban catches them after a couple tries, but without fail new ips spin up and resume.

It’s futile. I don’t have password auth on. They’ll never get in.

It’s just like people walking down the street coming up to your door to see if it’s unlocked. Or trying car doors for the same. They can try all they want, they’re not getting in.

Moral of the story: yeah it feels scary, but it’s really not. Make sure you have password auth and root login turned off, and fail2ban is a good call. Otherwise ignore it, it’s just something that will always happen on the internet.

If a Plex server mostly, get an N95 or N100 mini PC. Or really any new-ish NUC or mini PC will do.

Nah. Debian for servers.