Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who's Attacking My Server?

bastian.rieck.me

Post reply on HN
Print view View original

31–40 of 231 posts

Re: Who's Attacking My Server?

#31

Post by cube00 »

zinekeller wrote: post #28
fabian2k wrote: post #20

Earlier quoted context omitted.

For SSH simply disallowing passwords entirely removes this problem. For me that's the one single thing that dramatically improves defense against any kind of brute force or untargeted attack.

I'm actually shocked that you're the first one to mention it. Only use public key logins and if you're not targeted and if it's practical in your workflow change the port (definitely not for security, only so that sshd won't eat as much CPU time from bruteforce attempts).

Just make sure you don't use a port any higher then 1024 or else a non root process can start up and take its place if the real one crashes.

Re: Who's Attacking My Server?

#32

Post by arjvik »

NavinF wrote: post #19
Topolomancer wrote: post #9

Earlier quoted context omitted.

Thanks, I was unaware of this---I initially (naively?) thought that being banned would at least deter some wannabe attackers. In your experience, does it do anything if I start collecting some reports on repeat offenders and notify their ISP? Or is that just more wishful thinking of my part?

Eh I’ve scanned the entire IPv4 space and tested default passwords over ssh from both AWS and my Comcast connection at home and never got banned from either one. I’m sure it can happen, but it’s no big deal. The GP is right: If you use ed25519 keys, looking at logs and playing whack a mole with countries is just security theater for people who are new to the internet and get scared when their MOTD says “500 failed lo…

How long did scanning the entire IPv4 space take?

Re: Who's Attacking My Server?

#33

Post by cube00 »

Topolomancer wrote: post #9
tptacek wrote: post #4

Fail2ban is theater on a properly configured server --- and, increasingly since the mid 2010's, you've had to go out of your way to have a badly configured SSH server. Either way, it's something you have to add specifically to your server, so if you're going to do that, use the same energy to just make sure your server is configured properly. Yeah, yeah, I know it "keeps your logs clean". So does grep, though.

Thanks, I was unaware of this---I initially (naively?) thought that being banned would at least deter some wannabe attackers. In your experience, does it do anything if I start collecting some reports on repeat offenders and notify their ISP? Or is that just more wishful thinking of my part?

As an individual your reports will likely be ignored, however if you do want to report consider contributing to a service like AbuseIPDB. It probably doesn't do much either but at least it feels like I'm doing my part to report abuse and maybe some ISPs will choose to act on it.

Re: Who's Attacking My Server?

#34

Post by vdfs »

logifail wrote: post #27

> "failed login attempts" At least with SSH, once you move to only using key-based authentication, don't you simply stop worrying about weak passwords and failed logins? You can then focus on keeping up to date with security patches, which is at least as important, but takes far less time.

Also changing the default port. weird these two simple options are not used. They won't stop those automated attempts from appearing in your logs, but will greatly decrease them

Re: Who's Attacking My Server?

#35

Post by taf2 »

Topolomancer wrote: post #9
tptacek wrote: post #4

Fail2ban is theater on a properly configured server --- and, increasingly since the mid 2010's, you've had to go out of your way to have a badly configured SSH server. Either way, it's something you have to add specifically to your server, so if you're going to do that, use the same energy to just make sure your server is configured properly. Yeah, yeah, I know it "keeps your logs clean". So does grep, though.

Thanks, I was unaware of this---I initially (naively?) thought that being banned would at least deter some wannabe attackers. In your experience, does it do anything if I start collecting some reports on repeat offenders and notify their ISP? Or is that just more wishful thinking of my part?

You should just not allow any IP to access your server to begin with… have a list of trusted IPs - this and only allow public / private key access with a second factor device and I think you should be good…

Re: Who's Attacking My Server?

#36

Post by cube00 »

cm2187 wrote: post #12

I do a similar monitoring on my personal servers which shouldn’t be of interest to anyone really. Interestingly I don’t think I have ever seen anyone trying to login on any protocol using IPv6. Which is why it is most likely bots scanning the whole ipv4 address space rather than targeting those servers.

I'm keen to see where this goes as we move to IPv6 only services. The claim now is IPv6 is too large to scan but maybe they're not bothering because most IPv6 servers also listen on IPv4.

Once they move to IPv6 only (after I need to sell my house to afford a single IPv4 address) it might be worth the extra scan time.

Re: Who's Attacking My Server?

#37

Post by ganzuul »

ValtteriL wrote: post #17

"I am wondering whether it would be legal to try to automatically check for known exploits, in order to ‘p0wn’ the wannabe-attacker and disable their system instead." Absolutely illegal. Don't do that. Also, if your setup is enough at controlling the nuisance, why bother? -- Good work though, liked the visualization of attacker IP locations! Have you considered running at least SSH on nonstandard port?

What about hold your ground laws, or self defense? It may be time to consider these.

Re: Who's Attacking My Server?

#38

Post by NavinF »

arjvik wrote: post #32
NavinF wrote: post #19

Earlier quoted context omitted.

Eh I’ve scanned the entire IPv4 space and tested default passwords over ssh from both AWS and my Comcast connection at home and never got banned from either one. I’m sure it can happen, but it’s no big deal. The GP is right: If you use ed25519 keys, looking at logs and playing whack a mole with countries is just security theater for people who are new to the internet and get scared when their MOTD says “500 failed lo…

How long did scanning the entire IPv4 space take?

~4 hours on a 1G port, IIRC

I’m sure you could do it a lot faster with a better CPU and 20% commit on a 10G port

Re: Who's Attacking My Server?

#39

Post by logifail »

cube00 wrote: post #29
logifail wrote: post #27

> "failed login attempts" At least with SSH, once you move to only using key-based authentication, don't you simply stop worrying about weak passwords and failed logins? You can then focus on keeping up to date with security patches, which is at least as important, but takes far less time.

It's still noise in the log you can do without if you really want to know what's going on with your system. For me I firewall ssh to only accept from known IPs. Worst case if I have to expand that list I'll login via the VPS provider's console to do that.

Hmm, there's noise, and there's noise.

If you know that password auth is disabled, don't you just grep out all the disconnected/preauth and 'invalid user' lines before you even look at (or process) auth.log?

On a box where password auth is enabled, you can't be sure what's signal and what's noise.

Re: Who's Attacking My Server?

#40

Post by kkirsche »

arjvik wrote: post #32
NavinF wrote: post #19

Earlier quoted context omitted.

Eh I’ve scanned the entire IPv4 space and tested default passwords over ssh from both AWS and my Comcast connection at home and never got banned from either one. I’m sure it can happen, but it’s no big deal. The GP is right: If you use ed25519 keys, looking at logs and playing whack a mole with countries is just security theater for people who are new to the internet and get scared when their MOTD says “500 failed lo…

How long did scanning the entire IPv4 space take?

That depends on the machine you are using. Tools like mass scan to locate open ssh ports and then testing them doesn’t need to take long if you have a beefy machine and pipe to the internet.
Post reply on HN