Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who's Attacking My Server?

bastian.rieck.me

Post reply on HN
Print view View original

121–130 of 231 posts

Re: Who's Attacking My Server?

#121

Post by kortilla »

LinuxBender wrote: post #106
ganzuul wrote: post #64

Earlier quoted context omitted.

I'm not. I wish to consider if defending one's home might include defending one's electronic presence, however that may manifest itself. For example, you have a home security system that you monitor from your mobile device. Perhaps you have your pet at home, there have been break-ins in your neighborhood, and just after someone showed up on your doorstep the CCTV feed cuts. You are not at home and the cops are busy.…

I totally get the idea and I agree with the intent. There are some places that allow defending a home using automation using non lethal force but even that comes with some risk of civil legal issues. This is why I suggest consulting with a lawyer. Even with non lethal means one would want to ensure it is legal in their location and that they have the proper signs with appropriate verbiage and mitigating controls in p…

> There are some places that allow defending a home using non lethal force but even that comes with some risk of civil legal issues.

You can defend your home with lethal force in many states in the US. No verbiage, signs or disclaimers required.

Re: Who's Attacking My Server?

#122

Post by tptacek »

chockchocschoir wrote: post #55
vngzs wrote: post #50

Earlier quoted context omitted.

Indeed. The author could have spent 15 minutes setting up Tailscale [0] and not expose any listening administration ports to the Internet at all. If they wanted to avoid using a hosted service, Wireguard alone is incredibly defensive against attackers who do not have access to the secret material. Tailscale basically just adds some NAT traversal [1] and OIDC login wrappers. [0]: https://tailscale.com/ [1]: https://ta…

Before complicating the setup even more (by adding more software), I'd opt to make sure I configure the software I already have before going down that route. Removing password login + changing the port would already remove any attack surface and make most scans not finding it at all. And if I'd still be annoyed by the amount of log items at that point, I'd add MAC/IP filtering at the firewall level before getting to…

What exactly are you trying to accomplish with MAC filtering?

Re: Who's Attacking My Server?

#123

Post by LinuxBender »

kortilla wrote: post #121
LinuxBender wrote: post #106

Earlier quoted context omitted.

I totally get the idea and I agree with the intent. There are some places that allow defending a home using automation using non lethal force but even that comes with some risk of civil legal issues. This is why I suggest consulting with a lawyer. Even with non lethal means one would want to ensure it is legal in their location and that they have the proper signs with appropriate verbiage and mitigating controls in p…

> There are some places that allow defending a home using non lethal force but even that comes with some risk of civil legal issues. You can defend your home with lethal force in many states in the US. No verbiage, signs or disclaimers required.

Agreed, though AFAIK only if it is you doing the defending of yourself and your family, not automation, not booby-traps. This discussion started around defending property remotely vs. defending ones own life in jeopardy.

Re: Who's Attacking My Server?

#124

Post by pvg »

tptacek wrote: post #10
Topolomancer wrote: post #9

Earlier quoted context omitted.

Thanks, I was unaware of this---I initially (naively?) thought that being banned would at least deter some wannabe attackers. In your experience, does it do anything if I start collecting some reports on repeat offenders and notify their ISP? Or is that just more wishful thinking of my part?

Absolutely nothing will be done about reports of people running SSH scanners against your host; it would be like Cnut on his seashore throne ruling the waves to recede: even in the unlikely event that a hosting provider shut someone off (we probably would, if you told us), they'd be followed by 10,000 more.

ruling the waves

This aggression will not stand

Re: Who's Attacking My Server?

#125

Post by raggi »

tptacek wrote: post #119
raggi wrote: post #90

Earlier quoted context omitted.

I've been enough in the SSH code to be somewhat terrified by it. The main server loop has so many nested macro conditionals it's exceptionally difficult to read precisely. That said, fail2ban had an RCE in the last year, so if we're considering trustworthy surfaces, I definitely agree and practice that I trust openssh a whole lot more than a lot of other software that may come up in the discussion.

qmail has one of the most notoriously inscrutable codebases of all time, and it has a startlingly good track record, because there's a coherent security design behind it; the same --- to a greater extent! --- goes for OpenSSH.

There's a side of this that I agree with, however there's other sides.

The reason I've been in the code base a bunch is because I've taken on support of forks bootstrapped by others in various scenarios.

Design safety goes a fairly long way, but it's so easy to screw up patching code shaped this way. I might trust the core, but I don't trust external patches.

The problem in practice is, distros can't help themselves.

Re: Who's Attacking My Server?

#126

Post by michaelcampbell »

chockchocschoir wrote: post #78
fuzzy2 wrote: post #74

I just ban China entirely from accessing my server. There's nothing on it a Chinese person could be interested in, just personal stuff and a private forum. Doing so has tremendously reduced the overall (remaining) abuse traffic volume. It's quite easy and efficient to do this using IPSet. IP ranges associated with China are available on the net.

Before going about a blocking potential people who are in fact interested in your content/service (which you can't know if they are or not based on the country), did you do the bare minimum to secure your server against attackers from any other location, namely changed from the default password and disabled password login? Your approach to security has a number of issues. First, you don't know if someone is actually…

I DO run a "public" service, in that it provides some info to people. However I run it at totally my own cost, the information is for entertainment value only (and not in the "I just say that to get around this being horrible in some way"; it's literally information about gaming and games), and I just don't need the hassle of the constant hack attempts. I block China and Russia, and have for years, using publicly available IP ranges.

Yes, I know it's not going to get just China and Russia. Yes I know I'm blocking false positives. Yes I know I'm allowing false negatives.

And honestly, I couldn't care less. It's my service, my information, my time, and my money, and I don't feel the least bit bad nor swayed by some appeal to morality or fairness.

> Your approach to security has a number of issues.

Your examples are a bit of non-sequitur. If I OVERBAN, I'm not decreasing my security. The non-(Chinese hacker) visitor in China can't get in, that's not a security issue. IP's being flagged as Chinese not being in China... can't get in also not a security issue. Vice versa is a bit of a security issue, with which the second layer of my security onion deals.

Re: Who's Attacking My Server?

#127

Post by walrus01 »

fuzzy2 wrote: post #74

I just ban China entirely from accessing my server. There's nothing on it a Chinese person could be interested in, just personal stuff and a private forum. Doing so has tremendously reduced the overall (remaining) abuse traffic volume. It's quite easy and efficient to do this using IPSet. IP ranges associated with China are available on the net.

this seems to presume that malicious things originating in china scanning/probing other peoples' IP ranges don't use proxies or rented VMs, or relay compromised hosts almost anywhere in the world, etc. all that banning chinese /16 or /12 size netblocks will do is cut down on the clutter in your logs, not actually accomplish anything.

getting scanned and probed by peoples' automated tools looking for vulnerabel daemon RCEs has been a log clutter issue for about 25 years or more now. it's part of the background noise of the internet. ever since the days of having your http daemon logs cluttered up with GET DEFAULT.IDA stuff and similar in 2001.

https://www.google.com/search?client=firefox-b-1-d&q=get+def...

put more effort into ensuring that public facing daemons are totally up to date and hardened against external compromise. Or better yet don't have them public facing at all, if you can admin your server via an ssh daemon that only listens on a logical vpn interface or some sort of OOB interface.

Re: Who's Attacking My Server?

#128

Post by plufz »

anderspitman wrote: post #101
plufz wrote: post #82

Earlier quoted context omitted.

hmm I reason sooner or later a scanner will find an xss/sql exploit/whatever? why give scanners free access to search endlessly for possible exploits when you can fail2ban? all servers have possible exploits if they expose a medium complex service. (if ssh is all you expose and you only allow keys, fine!)

I'm curious, is it common for scanners to look for vulnerabilities in bespoke servers, or do they usually look for known vulnerabilities in specific versions of popular servers like WordPress, Apache, etc?

My experience is a mix of both. Lots of looking for wordpress, phpmyadmin, etc but also scraping my own GET-parameters and FORMs looking for sql exploits etc.

Re: Who's Attacking My Server?

#129

Post by arc-in-space »

cube00 wrote: post #31
zinekeller wrote: post #28

Earlier quoted context omitted.

I'm actually shocked that you're the first one to mention it. Only use public key logins and if you're not targeted and if it's practical in your workflow change the port (definitely not for security, only so that sshd won't eat as much CPU time from bruteforce attempts).

Just make sure you don't use a port any higher then 1024 or else a non root process can start up and take its place if the real one crashes.

Oh, good to know, I will ignore this advice and excitedly await for this to happen to me

Re: Who's Attacking My Server?

#130

Post by gkbrk »

fuzzy2 wrote: post #95
qwertox wrote: post #86

Earlier quoted context omitted.

I do the same, but my issue is with rented servers on AWS, Digital Ocean and the like. There's no way of knowing who owns a rented IP address, the WHOIS record just outputs "US", which is meaningles. I think there's an need for forcing service providers to group IP blocks by the nationality of who rents them. Just to be clear, this is in the context of my private servers which host my mailserver as well as my persona…

> I think there's an need for forcing service providers to group IP blocks by the nationality of who rents them. But what would that accomplish? Unlike rogue ISPs in other countries, big cloud providers have abuse reporting that actually works. Or just block all of them outright if they do not need to access your services.

Depends on the country the cloud provider is located in. I have had zero luck getting anything taken down by reporting to abuse emails or forms of Aliyun, for example.

I have had much better luck with US or EU based cloud providers. In particular, I remember DigitalOcean being very responsive.

Post reply on HN