Persistant SSH Threats? • Hacker News Board

Re: Persistant SSH Threats?

#21

Post by parliament32 » Thu, Jan 23, 2020, 8:59 PM UTC

icedchai wrote: post #18

parliament32 wrote: post #11

Earlier quoted context omitted.

SSH is less secure on an unprivileged port, this is a bad move. Use ssh keys and fail2ban, and filter your logs if you care about the attempts that much. This is like complaining that you're seeing web scrapers in your http access log: it's just background noise, it doesn't matter.

I did not suggest changing it to an unprivileged port, just a non default. Also you can change the Linux privileged port range with sysctl.

>you can change the Linux privileged port range with sysctl

I'm pretty sure you can't without recompiling the kernel, it's defined in the source in include/net/sock.h here: https://github.com/torvalds/linux/blob/master/include/net/so...

Re: Persistant SSH Threats?

#22

Post by daly » Thu, Jan 23, 2020, 9:22 PM UTC

I have SSH disabled.

Re: Persistant SSH Threats?

#23

Post by lbonanomi » Thu, Jan 23, 2020, 9:31 PM UTC

At least this can make for very exciting wallpapers?

https://dev.to/lbonanomi/hello-worm-mapping-ssh-probes-with-...

Re: Persistant SSH Threats?

#24

Post by Snawoot » Thu, Jan 23, 2020, 9:35 PM UTC

daly wrote: post #22

I have SSH disabled.

Are you Telnet or RDP person?

Re: Persistant SSH Threats?

#25

Post by Snawoot » Thu, Jan 23, 2020, 9:39 PM UTC

Yeah, it's common. I hide my critical services with pyknock[1] - it's a modern successor of port-knocking implementation, based on HMAC signatures rather than on simple port sequence.

[1] - https://pypi.org/project/pyknock/

Re: Persistant SSH Threats?

#26

Post by icedchai » Thu, Jan 23, 2020, 10:10 PM UTC

parliament32 wrote: post #21

icedchai wrote: post #18

Earlier quoted context omitted.

I did not suggest changing it to an unprivileged port, just a non default. Also you can change the Linux privileged port range with sysctl.

>you can change the Linux privileged port range with sysctl I'm pretty sure you can't without recompiling the kernel, it's defined in the source in include/net/sock.h here: https://github.com/torvalds/linux/blob/master/include/net/so...

Newer kernels have the sysctl: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

Re: Persistant SSH Threats?

#27

Post by parliament32 » Thu, Jan 23, 2020, 10:13 PM UTC

icedchai wrote: post #26

parliament32 wrote: post #21

Earlier quoted context omitted.

>you can change the Linux privileged port range with sysctl I'm pretty sure you can't without recompiling the kernel, it's defined in the source in include/net/sock.h here: https://github.com/torvalds/linux/blob/master/include/net/so...

Newer kernels have the sysctl: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

Oh very cool, thanks for the link! Learn something new every day

Re: Persistant SSH Threats?

#28

Post by SlipperySlope » Thu, Jan 23, 2020, 10:58 PM UTC

With X.509 certificates (publickey) and no passwords enabled, my new AWS server got lots of failed entries in /var/log/auth.log.

Following best practices, I set my sshd_config to specify another listening port - not 22.

My log is now clear of failed attempts.

Re: Persistant SSH Threats?

#29

Post by actionowl » Sun, Jan 26, 2020, 3:43 PM UTC

Blacklistd (available natively on FreeBSD and NetBSD) are a good defense against these attacks. If you're using Linux you'll have to use fail2ban or something that scans log files for a similar. Using public key authentication and disabling password authentication is also a good idea.