Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who's Attacking My Server?

bastian.rieck.me

Post reply on HN
Print view View original

51–60 of 231 posts

Re: Who's Attacking My Server?

#51

Post by cm2187 »

cube00 wrote: post #36
cm2187 wrote: post #12

I do a similar monitoring on my personal servers which shouldn’t be of interest to anyone really. Interestingly I don’t think I have ever seen anyone trying to login on any protocol using IPv6. Which is why it is most likely bots scanning the whole ipv4 address space rather than targeting those servers.

I'm keen to see where this goes as we move to IPv6 only services. The claim now is IPv6 is too large to scan but maybe they're not bothering because most IPv6 servers also listen on IPv4. Once they move to IPv6 only (after I need to sell my house to afford a single IPv4 address) it might be worth the extra scan time.

The extra scan time? You certainly can't possibly physically scan the whole 128bit address space. I am not even sure you can if you know which /48 prefixes have been assigned.

Re: Who's Attacking My Server?

#52

Post by chockchocschoir »

cube00 wrote: post #36
cm2187 wrote: post #12

I do a similar monitoring on my personal servers which shouldn’t be of interest to anyone really. Interestingly I don’t think I have ever seen anyone trying to login on any protocol using IPv6. Which is why it is most likely bots scanning the whole ipv4 address space rather than targeting those servers.

I'm keen to see where this goes as we move to IPv6 only services. The claim now is IPv6 is too large to scan but maybe they're not bothering because most IPv6 servers also listen on IPv4. Once they move to IPv6 only (after I need to sell my house to afford a single IPv4 address) it might be worth the extra scan time.

While IPv4 in it's entirely is trivial to scan (could do it in ~5 minutes more or less with the right hardware), usually you'd go for ranges to scan instead of the entire space, and IPv6 will still be feasible to scan for ranges, although they become larger.

Re: Who's Attacking My Server?

#53

Post by whartung »

71a54xd wrote: post #41
taf2 wrote: post #35

Earlier quoted context omitted.

You should just not allow any IP to access your server to begin with… have a list of trusted IPs - this and only allow public / private key access with a second factor device and I think you should be good…

I like to be able to maintain contact with my servers outside of a few specific ip's - I've locked myself out far too many times when I whitelist a very small number. Anyone have a better workaround for this?

Perhaps a port knock.

I don't know the mechanics, but a port knock is hitting pre-defined ports in a pre-defined order. When you "shave and a haircut" the ports properly, the server opens something up. In this case white listing (gray listing?) the IP that the knock came from.

You could add a layers to it to make it more complicated.

Re: Who's Attacking My Server?

#54

Post by sk5t »

matja wrote: post #49
tptacek wrote: post #4

Fail2ban is theater on a properly configured server --- and, increasingly since the mid 2010's, you've had to go out of your way to have a badly configured SSH server. Either way, it's something you have to add specifically to your server, so if you're going to do that, use the same energy to just make sure your server is configured properly. Yeah, yeah, I know it "keeps your logs clean". So does grep, though.

If fail2ban is theater, so is a firewall, so is SELinux, so are filesystem permissions (a properly configured process would only read/write the files it's supposed to, right?). If an remote vuln needs some stack-smashing technique that has a low probability of success, fail2ban is going to to slow that down - perhaps in a way that makes it more obvious in logs, buying you time to discover your broken configuration or…

> time to find that your database is listening on 0.0.0.0

I think that this would be the norm and desirable for databases serving clients other than the local host's. Plopping the database server onto a public network and allowing anyone at all to talk to it, on the other hand...

Re: Who's Attacking My Server?

#55

Post by chockchocschoir »

vngzs wrote: post #50
tptacek wrote: post #4

Fail2ban is theater on a properly configured server --- and, increasingly since the mid 2010's, you've had to go out of your way to have a badly configured SSH server. Either way, it's something you have to add specifically to your server, so if you're going to do that, use the same energy to just make sure your server is configured properly. Yeah, yeah, I know it "keeps your logs clean". So does grep, though.

Indeed. The author could have spent 15 minutes setting up Tailscale [0] and not expose any listening administration ports to the Internet at all. If they wanted to avoid using a hosted service, Wireguard alone is incredibly defensive against attackers who do not have access to the secret material. Tailscale basically just adds some NAT traversal [1] and OIDC login wrappers. [0]: https://tailscale.com/ [1]: https://ta…

Before complicating the setup even more (by adding more software), I'd opt to make sure I configure the software I already have before going down that route. Removing password login + changing the port would already remove any attack surface and make most scans not finding it at all. And if I'd still be annoyed by the amount of log items at that point, I'd add MAC/IP filtering at the firewall level before getting to the point of adding something like Tailscale.

Unless I had multiple users who'd need to login of course, but then Tailscale suddenly become a paid product, and I'd probably add another instance as a bastion host at that point.

I guess my point is: Make sure the software you already have is configured the right way before adding more software on top.

Re: Who's Attacking My Server?

#56

Post by LadyCailin »

mistrial9 wrote: post #25
Topolomancer wrote: post #3

Earlier quoted context omitted.

Good point; there used to be some issues with this since my dad is an interpreter for Russian, so we used to have some legitimate business there (probably not relevant, but his clients would essentially come to Europe to be trained in certain medical equipment)...but recent events might probably force early retirement for him. Somewhat unrelated: I have noticed that SPAM from Russian servers stopped on Feb 23 right b…

does anyone here recognize the difference between civilians and participants in armed conflict? medical in particular, right?

Tell that to the Russians bombing civilian targets in Ukraine. If the worst happening to Russian civilians right now is that they can’t access someone’s blog, well, I can think of far worse things for civilians to have to deal with.

Re: Who's Attacking My Server?

#57

Post by Topolomancer »

ValtteriL wrote: post #17

"I am wondering whether it would be legal to try to automatically check for known exploits, in order to ‘p0wn’ the wannabe-attacker and disable their system instead." Absolutely illegal. Don't do that. Also, if your setup is enough at controlling the nuisance, why bother? -- Good work though, liked the visualization of attacker IP locations! Have you considered running at least SSH on nonstandard port?

Thanks!

I was debating the nonstandard port, but I left it like this to simplify connections for my users. If the traffic starts to continue like this, I might be forced to switch, though.

Re: Who's Attacking My Server?

#59

Post by PeterisP »

71a54xd wrote: post #41
taf2 wrote: post #35

Earlier quoted context omitted.

You should just not allow any IP to access your server to begin with… have a list of trusted IPs - this and only allow public / private key access with a second factor device and I think you should be good…

I like to be able to maintain contact with my servers outside of a few specific ip's - I've locked myself out far too many times when I whitelist a very small number. Anyone have a better workaround for this?

IMHO there's no need to worry (but you should disable password access), but if you really want to, port knocking is an option.

Re: Who's Attacking My Server?

#60

Post by pengaru »

Spooky23 wrote: post #47
tptacek wrote: post #4

Fail2ban is theater on a properly configured server --- and, increasingly since the mid 2010's, you've had to go out of your way to have a badly configured SSH server. Either way, it's something you have to add specifically to your server, so if you're going to do that, use the same energy to just make sure your server is configured properly. Yeah, yeah, I know it "keeps your logs clean". So does grep, though.

I think a better solution now is something like Tailscale for anything administrative. I’ve been doing this for Minecraft servers for a year or two, and it eliminates a ton of BS.

> I think a better solution now is something like Tailscale for anything administrative. I’ve been doing this for Minecraft servers for a year or two, and it eliminates a ton of BS.

All I'm hearing is that Tailscale is becoming an increasingly attractive bastion host to compromise, then use as a jump server to access heaps of poorly configured customer machines.

Post reply on HN