Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who's Attacking My Server?

bastian.rieck.me

Post reply on HN
Print view View original

11–20 of 231 posts

Re: Who's Attacking My Server?

#11

Post by Topolomancer »

tptacek wrote: post #10
Topolomancer wrote: post #9

Earlier quoted context omitted.

Thanks, I was unaware of this---I initially (naively?) thought that being banned would at least deter some wannabe attackers. In your experience, does it do anything if I start collecting some reports on repeat offenders and notify their ISP? Or is that just more wishful thinking of my part?

Absolutely nothing will be done about reports of people running SSH scanners against your host; it would be like Cnut on his seashore throne ruling the waves to recede: even in the unlikely event that a hosting provider shut someone off (we probably would, if you told us), they'd be followed by 10,000 more.

Thanks for the reality check, I appreciate it! At least I got a nice map out of this (and made sure that nothing was configured incorrectly, to the best of my knowledge)...

Re: Who's Attacking My Server?

#12

Post by cm2187 »

I do a similar monitoring on my personal servers which shouldn’t be of interest to anyone really. Interestingly I don’t think I have ever seen anyone trying to login on any protocol using IPv6. Which is why it is most likely bots scanning the whole ipv4 address space rather than targeting those servers.

Re: Who's Attacking My Server?

#13

Post by duxup »

superkuh wrote: post #7
zelon88 wrote: post #2

Geo fence them. There is no ROI to providing value to Russia or their partners. They only serve as launchpads for cyber attacks and recon anyway. Chances are any organic Russian would be forbidden from directly viewing your page anyway, so it's literally all bots. Organic Russians come from proxys and VPNs. Russia doesn't reciprocate knowledge or technology or philosophy or anything with value. Primary Russian digita…

Sure. But if you read the article you see the vast majority of the attacks and the most persistent ones seem to originate from China and Hong Kong.

It’s pretty common to geofence China too in my experience, for the same reasons.

It seems like malicious traffic would be more agile come from everywhere, but if you block those two countries you filter a great deal of it.

Re: Who's Attacking My Server?

#14

Post by uniqueuid »

This is a good opportunity to recommend nft blackhole [1].

Automatically block countries by CIDR blocks and known bad actor IPs. Auto-updates these lists and adds them to your firewall.

It's a 5 minute install and maintenance free afterwards.

Not perfect, but reduces attack surface and log spam.

[1] https://github.com/tomasz-c/nft-blackhole

Re: Who's Attacking My Server?

#15

Post by cm2187 »

tptacek wrote: post #4

Fail2ban is theater on a properly configured server --- and, increasingly since the mid 2010's, you've had to go out of your way to have a badly configured SSH server. Either way, it's something you have to add specifically to your server, so if you're going to do that, use the same energy to just make sure your server is configured properly. Yeah, yeah, I know it "keeps your logs clean". So does grep, though.

The problem is that you are also at the mercy of passwords selected by your users for smtp, imap, etc. So you still need some defence against brute force.

For administrative protocols (ssh, rdp, etc), I am a firm believer in IP whitelists, which give you the additional peace of mine of protecting you against future zero days, unless they affect the firewall.

Re: Who's Attacking My Server?

#16

Post by uniqueuid »

lmarcos wrote: post #5
zelon88 wrote: post #2

Geo fence them. There is no ROI to providing value to Russia or their partners. They only serve as launchpads for cyber attacks and recon anyway. Chances are any organic Russian would be forbidden from directly viewing your page anyway, so it's literally all bots. Organic Russians come from proxys and VPNs. Russia doesn't reciprocate knowledge or technology or philosophy or anything with value. Primary Russian digita…

Any documentation on how to do "geo fencing" without relying on third parties? Is it enough to have one big static list of ip addresses (or subnets)? How often does the list need to be updated?

See my recommendation in the top level thread.

Re: Who's Attacking My Server?

#17

Post by ValtteriL »

"I am wondering whether it would be legal to try to automatically check for known exploits, in order to ‘p0wn’ the wannabe-attacker and disable their system instead."

Absolutely illegal. Don't do that.

Also, if your setup is enough at controlling the nuisance, why bother?

--

Good work though, liked the visualization of attacker IP locations!

Have you considered running at least SSH on nonstandard port?

Re: Who's Attacking My Server?

#18

Post by bombcar »

Topolomancer wrote: post #11
tptacek wrote: post #10

Earlier quoted context omitted.

Absolutely nothing will be done about reports of people running SSH scanners against your host; it would be like Cnut on his seashore throne ruling the waves to recede: even in the unlikely event that a hosting provider shut someone off (we probably would, if you told us), they'd be followed by 10,000 more.

Thanks for the reality check, I appreciate it! At least I got a nice map out of this (and made sure that nothing was configured incorrectly, to the best of my knowledge)...

You can get a similar reduction in ssh scans simply by moving the port (and doing nothing else) as the majority of scans only hit port 22.

Whether this is worth the hassle is left to the reader: if you have passwords disabled and only use keys it really shouldn’t matter.

Re: Who's Attacking My Server?

#19

Post by NavinF »

Topolomancer wrote: post #9
tptacek wrote: post #4

Fail2ban is theater on a properly configured server --- and, increasingly since the mid 2010's, you've had to go out of your way to have a badly configured SSH server. Either way, it's something you have to add specifically to your server, so if you're going to do that, use the same energy to just make sure your server is configured properly. Yeah, yeah, I know it "keeps your logs clean". So does grep, though.

Thanks, I was unaware of this---I initially (naively?) thought that being banned would at least deter some wannabe attackers. In your experience, does it do anything if I start collecting some reports on repeat offenders and notify their ISP? Or is that just more wishful thinking of my part?

Eh I’ve scanned the entire IPv4 space and tested default passwords over ssh from both AWS and my Comcast connection at home and never got banned from either one. I’m sure it can happen, but it’s no big deal.

The GP is right: If you use ed25519 keys, looking at logs and playing whack a mole with countries is just security theater for people who are new to the internet and get scared when their MOTD says “500 failed logins”.

Re: Who's Attacking My Server?

#20

Post by fabian2k »

cm2187 wrote: post #15
tptacek wrote: post #4

Fail2ban is theater on a properly configured server --- and, increasingly since the mid 2010's, you've had to go out of your way to have a badly configured SSH server. Either way, it's something you have to add specifically to your server, so if you're going to do that, use the same energy to just make sure your server is configured properly. Yeah, yeah, I know it "keeps your logs clean". So does grep, though.

The problem is that you are also at the mercy of passwords selected by your users for smtp, imap, etc. So you still need some defence against brute force. For administrative protocols (ssh, rdp, etc), I am a firm believer in IP whitelists, which give you the additional peace of mine of protecting you against future zero days, unless they affect the firewall.

For SSH simply disallowing passwords entirely removes this problem. For me that's the one single thing that dramatically improves defense against any kind of brute force or untargeted attack.
Post reply on HN