For a couple of distros AFAICT, that IS the default -- with some sort of firewall, whether it be iptables or firewalld, installed and activated right out of the box. As far as password bangers, well, I always find denyhosts to be an INVALUABLE tool and always make it a part of ANY Linux build that I set up. -----Original Message----- From: centos-bounces at centos.org [mailto:centos-bounces at centos.org] On Behalf Of Nathan Duehr Sent: Thursday, July 30, 2015 4:24 PM To: CentOS mailing list <centos at centos.org> Subject: Re: [CentOS] Fedora change that will probably affect RHEL > On Jul 30, 2015, at 12:20, Warren Young <wyml at etr-usa.com> wrote: > > Meanwhile over here in CentOS land, you still see SSH password guessers banging on every public IP that responds to port 22. Why? Because it still occasionally works. Increase the password strength minima, and this class of worm, too, will quickly die out. If the Windows fix was firewall on by default, why isn’t that the appropriate “fix" for Linux distros? Why mess with the password strength or which daemons are running? Seems like it adds the necessary step of “STOP: If you turn off this, you’d better know what you’re doing”, without messing around with default settings of packages and/or password library configuration files.