sshd's New Reflex: Who Does PerSourcePenalties Lock Out?
On the server that runs this blog, fail2ban-client status sshd prints four lines and all four are zero: nobody banned, nobody failing. That is not the result of a tight defence; it is the result of sshd listening on a five-digit port instead of 22. Of the last 24 hours' 2,234 sshd log lines, exactly two belong to connections that closed without authenticating; the rest are my own automation's 484 key-based logins and a reverse tunnel's refused port forwards. Anyone looking at that picture would
🎯 Vulnerability: Remote Code Execution (RCE)
💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.