41–50 of 69 posts
If you haven't already, get fail2ban setup on the box to slow down all the attacks. And disable password login and switch to certs instead.
SSH key based auth does not use certificates. In the case of key-based-auth only, fail2ban is pointless.
> "Hahahahahaha, a successful login" Congratulations, you just violated the computer fraud and abuse act. Also, bravo for laying out for every reader of this post where they can find the vulnerable router and the credentials they can use to join you in breaking the law. This is the exact opposite of responsible disclosure; people like the author are why we will never get a less draconian cfaa. Thanks for that.
It is victim blaming to lay the tyranny of the state at the feet of those who are doing research and publishing unredacted results, even if this specific author is indeed a moron.
Its interesting how many HN users seem to be missing the point of a honeypot. He set this up deliberately to understand the frequency/types of attacks on a random machine on the internet. From my past experience, most of those CN computers are actually US zero day'd/patched running root kits/worms. It just happens to be that CN computers are more likely to be unpatched/running ancient software.
Change the SSH port...
Please don't rely on that alone: https://blog.shodan.io/hiding-in-plain-sight/
If you haven't already, get fail2ban setup on the box to slow down all the attacks. And disable password login and switch to certs instead.
Better yet, deploy OSSEC there. I would recommend it with the latest patches from here: https://dcid.me/ossec/
In my opinion less is better. RSA/4096-bit key encryption only. I don't even care if you use the root user. The ability for someone to crack a 4096-bit key is impossible in practice, and if your SSH server has a bug then it doesn't matter what fancy things you have setup.
Its interesting how many HN users seem to be missing the point of a honeypot. He set this up deliberately to understand the frequency/types of attacks on a random machine on the internet. From my past experience, most of those CN computers are actually US zero day'd/patched running root kits/worms. It just happens to be that CN computers are more likely to be unpatched/running ancient software.
what is a CN computer?
I got hit with >100,000 on my main desktop a few years ago when I was procrastinating fixing my heavy-handed fail2ban config. I noticed what was happening first from the lag it was causing. It turns out >10 SSH password attempts/second can eat up a significant portion of my 3GHz "Yorkfield"[1] CPU. It wasn't hard to discover the problem: the logfile was rapidly filling with failed SSH password attempts. This is particularly useless as I have used
PasswordAuthentication no
It's probably like the old joke where two hiker see a grizzly bear and one stops to re-tie his shoes. "You can't outrun a grizzly!" "I only have to outrun you."
[1] Q9650 (E0); it still works great, even if it's starting to show its age
> "Hahahahahaha, a successful login" Congratulations, you just violated the computer fraud and abuse act. Also, bravo for laying out for every reader of this post where they can find the vulnerable router and the credentials they can use to join you in breaking the law. This is the exact opposite of responsible disclosure; people like the author are why we will never get a less draconian cfaa. Thanks for that.
If you haven't already, get fail2ban setup on the box to slow down all the attacks. And disable password login and switch to certs instead.
SSH key based auth does not use certificates. In the case of key-based-auth only, fail2ban is pointless.
Earlier quoted context omitted.
what is a CN computer?
CN = china. So, computers based in china, although I am at a loss as to what the thread parent is saying exactly about "CN computers actually being US". Same with "zero day'd/patched" — aren’t those opposite notions?