Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who's Attacking My Server?

bastian.rieck.me

Post reply on HN
Print view View original

91–100 of 231 posts

Re: Who's Attacking My Server?

#91

Post by chockchocschoir »

criddell wrote: post #84
chockchocschoir wrote: post #78

Earlier quoted context omitted.

Before going about a blocking potential people who are in fact interested in your content/service (which you can't know if they are or not based on the country), did you do the bare minimum to secure your server against attackers from any other location, namely changed from the default password and disabled password login? Your approach to security has a number of issues. First, you don't know if someone is actually…

I don't think it matters if the geo-location table is correct or not. If traffic from an IP range is entirely malicious, block that IP range. If that range happens to be Chinese or from Florida it doesn't really matter, does it?

Correct, blocking a IP block based on that malicious traffic comes from there might be a worthwhile strategy (although I'd argue that it's less important than properly configuring your stuff anyways, getting a new IP is trivial), and also a strategy which is different than what fuzzy2 was describing, which is what I was arguing against.

Re: Who's Attacking My Server?

#92

Post by fuzzy2 »

chockchocschoir wrote: post #78
fuzzy2 wrote: post #74

I just ban China entirely from accessing my server. There's nothing on it a Chinese person could be interested in, just personal stuff and a private forum. Doing so has tremendously reduced the overall (remaining) abuse traffic volume. It's quite easy and efficient to do this using IPSet. IP ranges associated with China are available on the net.

Before going about a blocking potential people who are in fact interested in your content/service (which you can't know if they are or not based on the country), did you do the bare minimum to secure your server against attackers from any other location, namely changed from the default password and disabled password login? Your approach to security has a number of issues. First, you don't know if someone is actually…

Yes, the server is of course properly secured. There was something that made me do this in the past, but I don't remember. Never had any problems with it whatsoever.

I do know, because my services (except the forum) are for me exclusively. On the forum, I know everyone. None of the members live in China, have relatives in China or travel to China. If they cannot access the forum, they can contact me in another way.

Re: Who's Attacking My Server?

#93

Post by raggi »

71a54xd wrote: post #41
taf2 wrote: post #35

Earlier quoted context omitted.

You should just not allow any IP to access your server to begin with… have a list of trusted IPs - this and only allow public / private key access with a second factor device and I think you should be good…

I like to be able to maintain contact with my servers outside of a few specific ip's - I've locked myself out far too many times when I whitelist a very small number. Anyone have a better workaround for this?

Stop using fail2ban/tallow/etc, and follow a sensible guide like https://infosec.mozilla.org/guidelines/openssh to harden your ssh configuration. This will result in about half the attempts failing at protocol negotiation, long before auth (though that ratio is decreasing over time).

Wireguard is also very strong here, as it learned from this kind of problem in SSH and does not reply at all unless authentication succeeds. This makes debugging harder, but also makes leaving it openly listening quite a bit safer, as the protocol surface in pre-auth is absolutely minimal.

Re: Who's Attacking My Server?

#94

Post by chockchocschoir »

throwmeariver1 wrote: post #72
chockchocschoir wrote: post #48

Earlier quoted context omitted.

Looks not-so reliable. Either fetches a list of blocks from https://github.com/herrbischoff/country-ip-blocks which is a random GitHub repository that collects "straight from the Regional Internet Registries" without any stating any sources nor method for gathering it (which also, I'm assuming, is self-reported data from those registries), or it fetches it from https://www.ipdeny.com/ which currently runs with an exp…

Calling the repository of Marcel Bischoff a random GitHub repository. LOL

Yes, GitHub repositories are generally not considered trust-worthy sources of information unless you actually could cite your resources in the repository itself. This information gathered there has 1) no source stated and 2) no way of reproducing the information yourself, earning it the description of "A Random GitHub Repository", even when you try to appeal to authority.

Re: Who's Attacking My Server?

#95

Post by fuzzy2 »

qwertox wrote: post #86
fuzzy2 wrote: post #74

I just ban China entirely from accessing my server. There's nothing on it a Chinese person could be interested in, just personal stuff and a private forum. Doing so has tremendously reduced the overall (remaining) abuse traffic volume. It's quite easy and efficient to do this using IPSet. IP ranges associated with China are available on the net.

I do the same, but my issue is with rented servers on AWS, Digital Ocean and the like. There's no way of knowing who owns a rented IP address, the WHOIS record just outputs "US", which is meaningles. I think there's an need for forcing service providers to group IP blocks by the nationality of who rents them. Just to be clear, this is in the context of my private servers which host my mailserver as well as my persona…

> I think there's an need for forcing service providers to group IP blocks by the nationality of who rents them.

But what would that accomplish? Unlike rogue ISPs in other countries, big cloud providers have abuse reporting that actually works.

Or just block all of them outright if they do not need to access your services.

Re: Who's Attacking My Server?

#96

Post by Topolomancer »

mistrial9 wrote: post #25
Topolomancer wrote: post #3

Earlier quoted context omitted.

Good point; there used to be some issues with this since my dad is an interpreter for Russian, so we used to have some legitimate business there (probably not relevant, but his clients would essentially come to Europe to be trained in certain medical equipment)...but recent events might probably force early retirement for him. Somewhat unrelated: I have noticed that SPAM from Russian servers stopped on Feb 23 right b…

does anyone here recognize the difference between civilians and participants in armed conflict? medical in particular, right?

Couldn't agree more---let me point out that our (i.e. the German) government started sanctions along with the rest of most (all?) European countries. It's not our choice any more---my dad used to believe in the 'Ostpolitik' of Willy Brandt, and he's heartbroken to hear about the horrors of war :(

(my research institution has also put a stop on all projects involving Russian collaborators at the moment; on the one hand, I can understand this reaction, on the other hand, it creates even more problems and, as you say, does not distinguish between those responsible for the conflict and those who are not. This is not really not an easy space to navigate.)

Re: Who's Attacking My Server?

#97

Post by chockchocschoir »

fuzzy2 wrote: post #92
chockchocschoir wrote: post #78

Earlier quoted context omitted.

Before going about a blocking potential people who are in fact interested in your content/service (which you can't know if they are or not based on the country), did you do the bare minimum to secure your server against attackers from any other location, namely changed from the default password and disabled password login? Your approach to security has a number of issues. First, you don't know if someone is actually…

Yes, the server is of course properly secured. There was something that made me do this in the past, but I don't remember. Never had any problems with it whatsoever. I do know, because my services (except the forum) are for me exclusively. On the forum, I know everyone. None of the members live in China, have relatives in China or travel to China. If they cannot access the forum, they can contact me in another way.

Yeah, if you're running private services, then my point is moot of course, should have known :) Thanks for explaining though.

Re: Who's Attacking My Server?

#98

Post by Topolomancer »

chockchocschoir wrote: post #55
vngzs wrote: post #50

Earlier quoted context omitted.

Indeed. The author could have spent 15 minutes setting up Tailscale [0] and not expose any listening administration ports to the Internet at all. If they wanted to avoid using a hosted service, Wireguard alone is incredibly defensive against attackers who do not have access to the secret material. Tailscale basically just adds some NAT traversal [1] and OIDC login wrappers. [0]: https://tailscale.com/ [1]: https://ta…

Before complicating the setup even more (by adding more software), I'd opt to make sure I configure the software I already have before going down that route. Removing password login + changing the port would already remove any attack surface and make most scans not finding it at all. And if I'd still be annoyed by the amount of log items at that point, I'd add MAC/IP filtering at the firewall level before getting to…

> I guess my point is: Make sure the software you already have is configured the right way before adding more software on top.

Couldn't agree more!

Re: Who's Attacking My Server?

#99

Post by jcynix »

qwertox wrote: post #86
fuzzy2 wrote: post #74

I just ban China entirely from accessing my server. There's nothing on it a Chinese person could be interested in, just personal stuff and a private forum. Doing so has tremendously reduced the overall (remaining) abuse traffic volume. It's quite easy and efficient to do this using IPSet. IP ranges associated with China are available on the net.

I do the same, but my issue is with rented servers on AWS, Digital Ocean and the like. There's no way of knowing who owns a rented IP address, the WHOIS record just outputs "US", which is meaningles. I think there's an need for forcing service providers to group IP blocks by the nationality of who rents them. Just to be clear, this is in the context of my private servers which host my mailserver as well as my persona…

> I think there's an need for forcing service providers to group IP blocks by the nationality of who rents them.

Would neither help nor work, as there's TOR and VPNs to access your servers from anywhere in the wirld.

Re: Who's Attacking My Server?

#100

Post by jandrese »

chockchocschoir wrote: post #52
cube00 wrote: post #36

Earlier quoted context omitted.

I'm keen to see where this goes as we move to IPv6 only services. The claim now is IPv6 is too large to scan but maybe they're not bothering because most IPv6 servers also listen on IPv4. Once they move to IPv6 only (after I need to sell my house to afford a single IPv4 address) it might be worth the extra scan time.

While IPv4 in it's entirely is trivial to scan (could do it in ~5 minutes more or less with the right hardware), usually you'd go for ranges to scan instead of the entire space, and IPv6 will still be feasible to scan for ranges, although they become larger.

I disagree that IPv6 will be feasible to scan except in unusual circumstances. There might be a case for scanning all of the low ranges ::1 through ::16 or so in the low 2001:: range, but even then you're searching for a rare needle in a haystack. Mass scans become quite impractical.
Post reply on HN