Hot answers tagged

2

AWS has a feature called VPC Flow Log that captures all the traffic coming to a VPC or a particular subnet or a particular network interface. You can setup VPC Flow log and these logs are then populated to AWS CloudWatch. It gives a very descriptive Log information and you can filter your query from that. Check more on AWS VPC Flow Log


1

You might try using the following for the backend SFTP servers: listen frontend_ssh 1.1.1.1:22 mode tcp option tcplog balance roundrobin server server1 2.2.2.2:22 server server2 3.3.3.3:22 I based the above on this post: http://jpmorris-iso.blogspot.com/2013/01/load-balancing-openssh-sftp-with-haproxy.html Hope ...


1

The bind and listen are not the same things nor things that can be done independently. They are consequent stages on the same port number. It is well described in this diagram from Wikipedia:


1

You can expose SSH on any port you desire. The clients must be aware of that, however. listen ssh-balanced bind <public-ip>:5022 mode tcp server term01 <internal-ip1>:22 check server term02 <internal-ip2>:22 check You need to use ssh -p5022 to connect, and scp -P5022 etc.


1

If you want to see dropped traffic you'll need to do the whitelist using a firewall running on your EC2 instance, not the AWS infrastructure. (Your server cannot log/see traffic that it doesn't receive). You may want to look into something like Fail2Ban. A word of advice, there are bot nets that will try to connect to your IP (especially on EC2) via SSH ...



Only top voted, non community-wiki answers of a minimum length are eligible