AS13335 doing SSH scanning • Hacker News Board

Re: AS13335 doing SSH scanning

#41

Post by throw0101a » Sat, Sep 25, 2021, 1:21 PM UTC

jimsi wrote: post #20

miyuru wrote: post #15

Earlier quoted context omitted.

If your ISP and the server support IPv6, just disable SSH on IPv4. Some of my servers don't even have any IPv4 connectivity and there haven't been any failed SSH logins over IPv6.

My OpenSSH is located on a non standard port, 22/tcp is going to the endlessh honeypot.

> endlessh honeypot.

*tarpit

A honeypot lets people "in" to see/research malware that's in the wild:

* https://en.wikipedia.org/wiki/Honeypot_(computing)

A tarpit just takes up the attacker's resources:

* https://en.wikipedia.org/wiki/Tarpit_(networking)

Re: AS13335 doing SSH scanning

#42

Post by vgb2k18 » Sat, Sep 25, 2021, 1:23 PM UTC

LinuxBender wrote: post #33

This is not unique to Cloudflare, Level3 or any of the other networks I've seen mentioned in this thread. The entire internet scans all the common ports and this should be expected to continue indefinitely. If this is causing alerts from your logging, there are a few options: - Implement a firewall on your instances. - Implement port knocking for sshd. - Move sshd to a non standard port to avoid the nmap/bot noise. -…

Adding: [-] whitelist allowed ip's for port 22. Requires static ip's client-side obviously [-] fail2ban if static ip's are not available.

Re: AS13335 doing SSH scanning

#43

Post by twodai » Sat, Sep 25, 2021, 1:29 PM UTC

LinuxBender wrote: post #33

This is not unique to Cloudflare, Level3 or any of the other networks I've seen mentioned in this thread. The entire internet scans all the common ports and this should be expected to continue indefinitely. If this is causing alerts from your logging, there are a few options: - Implement a firewall on your instances. - Implement port knocking for sshd. - Move sshd to a non standard port to avoid the nmap/bot noise. -…

My favorite is to implement a tarpit while moving the ssh port.

Re: AS13335 doing SSH scanning

#44

Post by joshenders » Sat, Sep 25, 2021, 1:34 PM UTC

jimsi wrote: post #18

benjojo12 wrote: post #16

To the best of my knowledge, the IP blocks in the 8.0.0.0/8 range announced by cloudflare are their VPN exit blocks. I had similar issues with them in the past spewing weird traffic. Didn't really ever reach a conclusion on it, other than just reducing logging for that error condition a scanner was triggering.

How did you discover this? Anyway thanks for additional information

jimsi, employees are also extremely active on Twitter. It’s not the most scalable but that’s usually my goto for eyebrow raising Cf related questions.

Re: AS13335 doing SSH scanning

#45

Post by kristianpaul » Sat, Sep 25, 2021, 1:46 PM UTC

I run OSSEC that comes with automatic responses for common SSH authentication events

Re: AS13335 doing SSH scanning

#46

Post by judge2020 » Sat, Sep 25, 2021, 1:49 PM UTC

throw0101a wrote: post #41

jimsi wrote: post #20

Earlier quoted context omitted.

My OpenSSH is located on a non standard port, 22/tcp is going to the endlessh honeypot.

> endlessh honeypot. *tarpit A honeypot lets people "in" to see/research malware that's in the wild: * https://en.wikipedia.org/wiki/Honeypot_(computing) A tarpit just takes up the attacker's resources: * https://en.wikipedia.org/wiki/Tarpit_(networking)

Not what most people run, but SSH honeypots are also useful:

https://lwn.net/Articles/848291/

Re: AS13335 doing SSH scanning

#47

Post by kentonv » Sat, Sep 25, 2021, 2:00 PM UTC

zinekeller wrote: post #19

Update: they apparently also have a paid product called "Cloudflare for Teams", which also uses the same infrastructure and are targeted for companies. Probably the reason they don't block out SSH is that companies do want SSH access - but I'm pretty sure that RDP access would be higher on the list. My friend working in an ISP has cleared the mystery for me - it's Cloudflare's Warp product (a semi-VPN (in the "telepo…

> Cloudflare has also categorically denied that their Worker product allows SSH connections - it is simply not designed for that, apparently.

Hi, I'm the tech lead of Workers, so I'll clarify.

At present, Workers can only generate HTTP traffic, because the only API we've given Workers for network communications is `fetch()`, which is HTTP-specific. This similar to how in-browser JavaScript today cannot open arbitrary TCP connections, because there's no API for it. It's likely we'll add an API for arbitrary TCP eventually, but at the moment it's not possible that this traffic comes from Workers.

(As far as where it did come from, I don't have any internal knowledge, but WARP traffic (that's our VPN-like service) seems like an obvious explanation to me.)

Re: AS13335 doing SSH scanning

#48

Post by themulticaster » Sat, Sep 25, 2021, 2:02 PM UTC

twodai wrote: post #43

LinuxBender wrote: post #33

This is not unique to Cloudflare, Level3 or any of the other networks I've seen mentioned in this thread. The entire internet scans all the common ports and this should be expected to continue indefinitely. If this is causing alerts from your logging, there are a few options: - Implement a firewall on your instances. - Implement port knocking for sshd. - Move sshd to a non standard port to avoid the nmap/bot noise. -…

My favorite is to implement a tarpit while moving the ssh port.

Does that mean that you automatically block IPs that try to login on port 22 (since they are obviously malicious/port scannners)? If yes, is there any specialized daemon for that or are you using firewall rules? Or are you running a SSH honeypot on port 22?

Re: AS13335 doing SSH scanning

#49

Post by [deleted] » Sat, Sep 25, 2021, 2:07 PM UTC

mcwhy wrote: post #10

vadfa wrote: post #4

Cloudflare has a VPN product, WARP. It's possible that they are clients of theirs doing the scanning. In any case I wouldn't think much of it. If you obsess over any garbage traffic you get you will go insane.

It could also be used for IP reputation, running ssh can be a sign of a proxy or other server/service that website owners might want to block.

[deleted]

Re: AS13335 doing SSH scanning

#50

Post by cpach » Sat, Sep 25, 2021, 2:12 PM UTC

As others have pointed out, disabling password-based logins for sshd is a must.

You can also go further if you like: Put the sshd service behind WireGuard (or spiped). Then malicious actors will never find your SSH ports.