Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who's Attacking My Server?

bastian.rieck.me

Post reply on HN
Print view View original

41–50 of 231 posts

Re: Who's Attacking My Server?

#41

Post by 71a54xd »

taf2 wrote: post #35
Topolomancer wrote: post #9

Earlier quoted context omitted.

Thanks, I was unaware of this---I initially (naively?) thought that being banned would at least deter some wannabe attackers. In your experience, does it do anything if I start collecting some reports on repeat offenders and notify their ISP? Or is that just more wishful thinking of my part?

You should just not allow any IP to access your server to begin with… have a list of trusted IPs - this and only allow public / private key access with a second factor device and I think you should be good…

I like to be able to maintain contact with my servers outside of a few specific ip's - I've locked myself out far too many times when I whitelist a very small number.

Anyone have a better workaround for this?

Re: Who's Attacking My Server?

#42

Post by Terry_Roll »

> Who's Attacking My Server?

Probably the security services and some useful idiots who fall for the propaganda pumped out through the media.

Its divide and conquer, been going on since the The Holy Roman Empire, and it doesnt take much to hack switches or have agents in foreign countries so the geolocating attacks is worthless, its just something to mess with your mind.

Its keeps people busy though as you have found out!

Re: Who's Attacking My Server?

#43

Post by cube00 »

logifail wrote: post #39
cube00 wrote: post #29

Earlier quoted context omitted.

It's still noise in the log you can do without if you really want to know what's going on with your system. For me I firewall ssh to only accept from known IPs. Worst case if I have to expand that list I'll login via the VPS provider's console to do that.

Hmm, there's noise, and there's noise . If you know that password auth is disabled, don't you just grep out all the disconnected/preauth and 'invalid user' lines before you even look at (or process) auth.log? On a box where password auth is enabled, you can't be sure what's signal and what's noise.

I guess I'm also worried about an SSH zero day hitting that I could avoid if I firewall filter the source IPs.

I offer other services on the public internet so a zero day could hit them but I don't have a choice in those cases (eg. incoming mail on 25), however with SSH I don't need to offer it to the world so why take the risk in the first place?

Re: Who's Attacking My Server?

#44

Post by mimimi31 »

I once made a very similar visualization to see where people were trying to attack my servers from by adapting (e.g. use local geoip database file instead of ipinfo service) the Python script from [1], which uses folium to generate an interactive (standalone HTML file) heatmap of IP address locations.

[1] https://github.com/meesaltena/SSHHeatmap

Re: Who's Attacking My Server?

#45

Post by LinuxBender »

ganzuul wrote: post #37
ValtteriL wrote: post #17

"I am wondering whether it would be legal to try to automatically check for known exploits, in order to ‘p0wn’ the wannabe-attacker and disable their system instead." Absolutely illegal. Don't do that. Also, if your setup is enough at controlling the nuisance, why bother? -- Good work though, liked the visualization of attacker IP locations! Have you considered running at least SSH on nonstandard port?

What about hold your ground laws, or self defense? It may be time to consider these.

Those are generally for humans defending themselves in life threatening situations. I would suggest talking to a lawyer if you are going this route.

Re: Who's Attacking My Server?

#47

Post by Spooky23 »

tptacek wrote: post #4

Fail2ban is theater on a properly configured server --- and, increasingly since the mid 2010's, you've had to go out of your way to have a badly configured SSH server. Either way, it's something you have to add specifically to your server, so if you're going to do that, use the same energy to just make sure your server is configured properly. Yeah, yeah, I know it "keeps your logs clean". So does grep, though.

I think a better solution now is something like Tailscale for anything administrative. I’ve been doing this for Minecraft servers for a year or two, and it eliminates a ton of BS.

Re: Who's Attacking My Server?

#48

Post by chockchocschoir »

uniqueuid wrote: post #14

This is a good opportunity to recommend nft blackhole [1]. Automatically block countries by CIDR blocks and known bad actor IPs. Auto-updates these lists and adds them to your firewall. It's a 5 minute install and maintenance free afterwards. Not perfect, but reduces attack surface and log spam. [1] https://github.com/tomasz-c/nft-blackhole

Looks not-so reliable. Either fetches a list of blocks from https://github.com/herrbischoff/country-ip-blocks which is a random GitHub repository that collects "straight from the Regional Internet Registries" without any stating any sources nor method for gathering it (which also, I'm assuming, is self-reported data from those registries), or it fetches it from https://www.ipdeny.com/ which currently runs with an expired TLS certificate, which on top of everything, nft-blackhole ignores any issues with certificates anyways, leaving it wide open to MITM attacks (https://github.com/tomasz-c/nft-blackhole/blob/8a656ac0a803a...)

I wouldn't run that if I'd want something to reliably block someone from a specific country.

> Not perfect, but reduces attack surface and log spam.

You know what also does that? Setting up sshd properly in the first place.

Re: Who's Attacking My Server?

#49

Post by matja »

tptacek wrote: post #4

Fail2ban is theater on a properly configured server --- and, increasingly since the mid 2010's, you've had to go out of your way to have a badly configured SSH server. Either way, it's something you have to add specifically to your server, so if you're going to do that, use the same energy to just make sure your server is configured properly. Yeah, yeah, I know it "keeps your logs clean". So does grep, though.

If fail2ban is theater, so is a firewall, so is SELinux, so are filesystem permissions (a properly configured process would only read/write the files it's supposed to, right?).

If an remote vuln needs some stack-smashing technique that has a low probability of success, fail2ban is going to to slow that down - perhaps in a way that makes it more obvious in logs, buying you time to discover your broken configuration or out of date software. Same way that a firewall buys you time to find that your database is listening on 0.0.0.0.

Re: Who's Attacking My Server?

#50

Post by vngzs »

tptacek wrote: post #4

Fail2ban is theater on a properly configured server --- and, increasingly since the mid 2010's, you've had to go out of your way to have a badly configured SSH server. Either way, it's something you have to add specifically to your server, so if you're going to do that, use the same energy to just make sure your server is configured properly. Yeah, yeah, I know it "keeps your logs clean". So does grep, though.

Indeed. The author could have spent 15 minutes setting up Tailscale [0] and not expose any listening administration ports to the Internet at all. If they wanted to avoid using a hosted service, Wireguard alone is incredibly defensive against attackers who do not have access to the secret material. Tailscale basically just adds some NAT traversal [1] and OIDC login wrappers.

[0]: https://tailscale.com/

[1]: https://tailscale.com/blog/how-nat-traversal-works/

Post reply on HN