Someday I'm going to put all the different pieces together and have things like SMTP & SSH auth failures, hosts hitting my spamtraps, bots scanning for open 23/TCP, and so on, to where I end up with one central host collecting all those events and injecting /32 routes for those IPs towards null0 in my core.
What SSH Hacking Attempts Look Like
61–70 of 186 posts
Re: What SSH Hacking Attempts Look Like
#62I am slowly closing all non-vital ports on my router and just letting services accessible from within the VPN. No open port = no hacking attempts. Investing a week of on-and-off studying and tinkering with openvpn is really paying off.
> No open port = no hacking attempts. That's just obviously nonsense? Closing the port does not change anything about the attempts. Nor about the success rate of the attempts, if you aren't being an idiot with insecure passwords.
I think the person above was maybe being too imprecise with their language. Obviously it doesn't affect the frequency of portscans and the like, but whitelisting ports is a reasonable approach to further mitigating your risks.
Re: What SSH Hacking Attempts Look Like
#63I never understood why people would use fail2ban or similar approaches. Just set proper password and move on. SSH traffic is tiny, it's not a problem. You'll never be hacked with a proper password. Let them waste their time.
I did just to keep the logs cleaner.
Re: What SSH Hacking Attempts Look Like
#64# cat /etc/ssh/sshd_config | grep PasswordAuthentication PasswordAuthentication no ^ it should return that. The end.
Don't forget about:
ChallengeResponseAuthentication noRe: What SSH Hacking Attempts Look Like
#65Earlier quoted context omitted.
Is it worth mentioning useless uses of cat in this day and age?
Please educate me
It's a holdover from the "good ol' days", see http://porkmail.org/era/unix/award.html#cat
Re: What SSH Hacking Attempts Look Like
#66Re: What SSH Hacking Attempts Look Like
#67I never understood why people would use fail2ban or similar approaches. Just set proper password and move on. SSH traffic is tiny, it's not a problem. You'll never be hacked with a proper password. Let them waste their time.
I did just to keep the logs cleaner.
Largely, I think, moving to an alternate port cut SSH crack attempts to near zero; but I use fail2ban too.
Re: What SSH Hacking Attempts Look Like
#68Earlier quoted context omitted.
> No open port = no hacking attempts. That's just obviously nonsense? Closing the port does not change anything about the attempts. Nor about the success rate of the attempts, if you aren't being an idiot with insecure passwords.
I think the person above was maybe being too imprecise with their language. Obviously it doesn't affect the frequency of portscans and the like, but whitelisting ports is a reasonable approach to further mitigating your risks.
Well, potentially.
But then, there is no fundamental difference between a service rejecting unauthorized connections and a firewall rejecting unauthorized connections. If your service is already rejecting unauthorized connections, you don't gain anything by also rejecting the same connections at the firewall, and that is why "No open port = no hacking attempts" is ultimately nonsense: It doesn't change anything about the attempts, and chances are it doesn't fundamentally change anything about the rejections either.
Also, adding a VPN exposes the VPN service to the internet, which thus adds attack surface in a different place. Which might be worth it if you need remote access to otherwise vulnerable services. But the simplistic view of "rejecting connections at the firewall" == "no more hacking attempts!11" is just that: simplistic.
Re: What SSH Hacking Attempts Look Like
#69# cat /etc/ssh/sshd_config | grep PasswordAuthentication PasswordAuthentication no ^ it should return that. The end.
Is it worth mentioning useless uses of cat in this day and age?
it isnt. cat + grep feels a lot more 'natural' to many users and makes 0 performance difference in 99.99% of usecases.