Persistant SSH Threats?

#1

Post by daly » Thu, Jan 23, 2020, 2:29 PM UTC

For the past few months my server has seen an SSH connection attempt about once a minute. There is no reason to SSH to my server as there is nothing on it except at static website.

The SSH connections are coming from seemingly random IP addresses, rarely from the same one twice.

Is anyone else seeing such connection patterns?

Re: Persistant SSH Threats?

#2

Post by em10fan » Thu, Jan 23, 2020, 2:51 PM UTC

Yes, this is normal.

Any server exposed on the internet will be probed constantly by botnets.

Re: Persistant SSH Threats?

#3

Post by ihalip » Thu, Jan 23, 2020, 2:59 PM UTC

I notice the same thing: connections from random combinations of IPs/usernames.

Sadly, that comes with having a public accessible server: people wanting to hack their way in.

Re: Persistant SSH Threats?

#4

Post by jmngomes » Thu, Jan 23, 2020, 3:10 PM UTC

That's normal, it's often referred to as background noise: https://en.wikipedia.org/wiki/Internet_background_noise

It stems from automated port scans sweeping IP ranges looking for vulnerable/exploitable systems.

A simple way to address it is to use something like fail2ban to ban repeat offenders. Blacklist services like abuseipdb.com may help further, but ban with caution.

Re: Persistant SSH Threats?

#5

Post by codegeek » Thu, Jan 23, 2020, 4:26 PM UTC

Welcome to the world of servers. There are these bots/scripts running all over the internet that are scanning for stuff like this and always trying to brute force into servers they can find and get in. The good news is that this is not only targeted at you. The bad news is that you cannot do much about them except ensuring that your servers are hardened and have the right security setup. There are tools like fail2ban etc. that can block those IP addresses but again, you cannot really stop them as you will get these hits from random IPs all over the world.

Re: Persistant SSH Threats?

#6

Post by slap_shot » Thu, Jan 23, 2020, 5:02 PM UTC

Related question that has crossed my mind: what is this risk exposure of a linux server that is accessible via the internet that has port 22 enabled, and only has users with --disabled-password set (requiring ssh connection)?

As a follow up, what is increased benefit (if any) if port 22 is only accessible by a certain IP address (e.g. my home address)?

Re: Persistant SSH Threats?

#7

Post by MrLabCoat » Thu, Jan 23, 2020, 6:32 PM UTC

slap_shot wrote: post #6

Related question that has crossed my mind: what is this risk exposure of a linux server that is accessible via the internet that has port 22 enabled, and only has users with --disabled-password set (requiring ssh connection)? As a follow up, what is increased benefit (if any) if port 22 is only accessible by a certain IP address (e.g. my home address)?

I do something similar but added a knock daemon and changed the default ssh port 22 to something else.

So far I haven’t had any issues, fail2ban works, and it seems safe.

I do have my home IP added to the whitelist and others set to drop.

I was told in a networking class this is the second best way to protect ssh other than not running ssh.

Any thoughts on this setup as well? Maybe oversights that I’m not seeing?

Re: Persistant SSH Threats?

#8

Post by icedchai » Thu, Jan 23, 2020, 6:41 PM UTC

Yes, for decades. Move SSH off of port 22 and you’ll see far fewer attempts.

Re: Persistant SSH Threats?

#9

Post by jmngomes » Thu, Jan 23, 2020, 6:51 PM UTC

slap_shot wrote: post #6

Related question that has crossed my mind: what is this risk exposure of a linux server that is accessible via the internet that has port 22 enabled, and only has users with --disabled-password set (requiring ssh connection)? As a follow up, what is increased benefit (if any) if port 22 is only accessible by a certain IP address (e.g. my home address)?

It's hard to quantify that "risk" in simple terms, but --disabled-password is a basic must as it seriously mitigates popular attack vectors like brute forcing.

Filtering ssh connections at firewall level helps, and certainly reduces log entries for port scans and can halt less sophisticated attackers, but it doesn't mitigate attack vectors like a DDoS or a well funded actor.

Re: Persistant SSH Threats?

#10

Post by kees99 » Thu, Jan 23, 2020, 7:22 PM UTC

icedchai wrote: post #8

Yes, for decades. Move SSH off of port 22 and you’ll see far fewer attempts.

No idea why you are being downvoted, this is a solid advice. Masscan [1] claims to scan whole IPv4 Internet for a single port in 5 minutes. Moving to a random high port would increase scan time 64000-fold, to 7 months.

You'd still be advised to disable password-based auth and/or configure fail2ban, though.

[1] https://github.com/robertdavidgraham/masscan