Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who's Attacking My Server?

bastian.rieck.me

Post reply on HN
Print view View original

21–30 of 231 posts

Re: Who's Attacking My Server?

#21

Post by hatware »

superkuh wrote: post #7
zelon88 wrote: post #2

Geo fence them. There is no ROI to providing value to Russia or their partners. They only serve as launchpads for cyber attacks and recon anyway. Chances are any organic Russian would be forbidden from directly viewing your page anyway, so it's literally all bots. Organic Russians come from proxys and VPNs. Russia doesn't reciprocate knowledge or technology or philosophy or anything with value. Primary Russian digita…

Sure. But if you read the article you see the vast majority of the attacks and the most persistent ones seem to originate from China and Hong Kong.

I thought that was so funny. The author even stated at the beginning that the Ukraine/Russia conflict was a reason for better security.

Re: Who's Attacking My Server?

#22

Post by Spooky23 »

lmarcos wrote: post #5
zelon88 wrote: post #2

Geo fence them. There is no ROI to providing value to Russia or their partners. They only serve as launchpads for cyber attacks and recon anyway. Chances are any organic Russian would be forbidden from directly viewing your page anyway, so it's literally all bots. Organic Russians come from proxys and VPNs. Russia doesn't reciprocate knowledge or technology or philosophy or anything with value. Primary Russian digita…

Any documentation on how to do "geo fencing" without relying on third parties? Is it enough to have one big static list of ip addresses (or subnets)? How often does the list need to be updated?

It depends on what you’re doing and who the legit users are.

The downside of static lists is that AWS, Azure, etc frequently purchase IP spaces and realign them with US datacenters. Probably not an issue for blocking Russia or China, but if you want US only traffic, or North American traffic, you can run into problems.

Re: Who's Attacking My Server?

#23

Post by naoqj »

zelon88 wrote: post #2

Geo fence them. There is no ROI to providing value to Russia or their partners. They only serve as launchpads for cyber attacks and recon anyway. Chances are any organic Russian would be forbidden from directly viewing your page anyway, so it's literally all bots. Organic Russians come from proxys and VPNs. Russia doesn't reciprocate knowledge or technology or philosophy or anything with value. Primary Russian digita…

>Organic Russians come from proxys and VPNs.

[citation needed] - I have Russian friends and they generally don't use proxies or VPNs.

Re: Who's Attacking My Server?

#24

Post by [deleted] »

duxup wrote: post #13
superkuh wrote: post #7

Earlier quoted context omitted.

Sure. But if you read the article you see the vast majority of the attacks and the most persistent ones seem to originate from China and Hong Kong.

It’s pretty common to geofence China too in my experience, for the same reasons. It seems like malicious traffic would be more agile come from everywhere, but if you block those two countries you filter a great deal of it.

[deleted]

Re: Who's Attacking My Server?

#25

Post by mistrial9 »

Topolomancer wrote: post #3
zelon88 wrote: post #2

Geo fence them. There is no ROI to providing value to Russia or their partners. They only serve as launchpads for cyber attacks and recon anyway. Chances are any organic Russian would be forbidden from directly viewing your page anyway, so it's literally all bots. Organic Russians come from proxys and VPNs. Russia doesn't reciprocate knowledge or technology or philosophy or anything with value. Primary Russian digita…

Good point; there used to be some issues with this since my dad is an interpreter for Russian, so we used to have some legitimate business there (probably not relevant, but his clients would essentially come to Europe to be trained in certain medical equipment)...but recent events might probably force early retirement for him. Somewhat unrelated: I have noticed that SPAM from Russian servers stopped on Feb 23 right b…

does anyone here recognize the difference between civilians and participants in armed conflict? medical in particular, right?

Re: Who's Attacking My Server?

#26

Post by cxf12 »

hatware wrote: post #21
superkuh wrote: post #7

Earlier quoted context omitted.

Sure. But if you read the article you see the vast majority of the attacks and the most persistent ones seem to originate from China and Hong Kong.

I thought that was so funny. The author even stated at the beginning that the Ukraine/Russia conflict was a reason for better security.

Russia represented a whopping 2% of his naughty list.

Re: Who's Attacking My Server?

#27

Post by logifail »

> "failed login attempts"

At least with SSH, once you move to only using key-based authentication, don't you simply stop worrying about weak passwords and failed logins?

You can then focus on keeping up to date with security patches, which is at least as important, but takes far less time.

Re: Who's Attacking My Server?

#28

Post by zinekeller »

fabian2k wrote: post #20
cm2187 wrote: post #15

Earlier quoted context omitted.

The problem is that you are also at the mercy of passwords selected by your users for smtp, imap, etc. So you still need some defence against brute force. For administrative protocols (ssh, rdp, etc), I am a firm believer in IP whitelists, which give you the additional peace of mine of protecting you against future zero days, unless they affect the firewall.

For SSH simply disallowing passwords entirely removes this problem. For me that's the one single thing that dramatically improves defense against any kind of brute force or untargeted attack.

I'm actually shocked that you're the first one to mention it. Only use public key logins and if you're not targeted and if it's practical in your workflow change the port (definitely not for security, only so that sshd won't eat as much CPU time from bruteforce attempts).

Re: Who's Attacking My Server?

#29

Post by cube00 »

logifail wrote: post #27

> "failed login attempts" At least with SSH, once you move to only using key-based authentication, don't you simply stop worrying about weak passwords and failed logins? You can then focus on keeping up to date with security patches, which is at least as important, but takes far less time.

It's still noise in the log you can do without if you really want to know what's going on with your system. For me I firewall ssh to only accept from known IPs. Worst case if I have to expand that list I'll login via the VPS provider's console to do that.
Post reply on HN