What is delete reject from...?

Stealth

Always other IPs:

3rd line. What is this?

aaPanel_Kern

Hello, which interface did you do what operation? What is the panel version?

Stealth

aaPanel_Kern
Hi, the newest stable(6.8.27) and updated all. The whole system on 2nd VPS of 6 VPS is very slow, others are okay.

aaPanel_Kern

Stealth
It is recommended to check the configuration and logs of fail2ban. Are there too many attacks?

Stealth

aaPanel_Kern

SSHD on other port and ban time is 864000:

FTP on default port with ban time 864000:

aaPanel_Kern

Stealth
The ssh service of the server is being scanned, it is recommended to change the ssh port

Stealth

aaPanel_Kern

I change port to 29xxx and clear logs.
Again more than 300 bans:

aaPanel_Kern

Stealth
These logs are old, not new.

Stealth

aaPanel_Kern

Click on refresh again:

aaPanel_Kern

Stealth
After replacing the ssh port, if the old port being connected can still be connected.

Close ssh for a period of time, and then open it
Restart the server

Stealth

aaPanel_Kern

Yet get FTP attacks:

Stealth

I closed the new 29xxx in aaPanel and stopped. But not have SSH access yet.

aaPanel_Kern

Stealth
It is recommended to prohibit others from accessing your port, and only allow your own IP to access. It can be set through the firewall or the security group of the server provider

Stealth

Contabo not have Firewall, I must change VPS provider or the panel (Cybe..p...) with CSF and LFD protection :/
19 hours with other panel seems work fine, max 2% load.
I so unhappy with fail2ban. Only this 1 VPS is nonstop attacked, I don´t know why...

aaPanel_Kern

It is recommended to check whether the IP of this VPS is scanned maliciously
You can also use the system firewall to only allow your IP to access the server

Stealth

aaPanel_Kern
How to check it?

aaPanel_Kern

Check firewall logs and fail2ban logs, ssh logs.