Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who's Attacking My Server?

bastian.rieck.me

Post reply on HN
Print view View original

141–150 of 231 posts

Re: Who's Attacking My Server?

#141

Post by Skiiing »

michaelcampbell wrote: post #126
chockchocschoir wrote: post #78

Earlier quoted context omitted.

Before going about a blocking potential people who are in fact interested in your content/service (which you can't know if they are or not based on the country), did you do the bare minimum to secure your server against attackers from any other location, namely changed from the default password and disabled password login? Your approach to security has a number of issues. First, you don't know if someone is actually…

I DO run a "public" service, in that it provides some info to people. However I run it at totally my own cost, the information is for entertainment value only (and not in the "I just say that to get around this being horrible in some way"; it's literally information about gaming and games), and I just don't need the hassle of the constant hack attempts. I block China and Russia, and have for years, using publicly ava…

You typed my thoughts exactly. I run a popular website, and I just block everything from China, and do a Captcha challenge for others such as Russia. People don't have the right to access my website. If a Chinese citizen is (correctly) angry about the situation then they need to petition their government to change the culture that permits massive continuous hacking attempts from their country.

I use Cloudflare which makes blocking countries simple, no need to keep updated IP lists.

Re: Who's Attacking My Server?

#142

Post by Skiiing »

lmarcos wrote: post #5
zelon88 wrote: post #2

Geo fence them. There is no ROI to providing value to Russia or their partners. They only serve as launchpads for cyber attacks and recon anyway. Chances are any organic Russian would be forbidden from directly viewing your page anyway, so it's literally all bots. Organic Russians come from proxys and VPNs. Russia doesn't reciprocate knowledge or technology or philosophy or anything with value. Primary Russian digita…

Any documentation on how to do "geo fencing" without relying on third parties? Is it enough to have one big static list of ip addresses (or subnets)? How often does the list need to be updated?

Cloudflare lets you block countries, ASNs and IP blocks.

Re: Who's Attacking My Server?

#143

Post by hutch120 »

I see these articles a lot, and always wonder why people go it alone. Can anyone link to a discussion about a distributed community run firewall? Does such a thing exist? If so, please comment.

Re: Who's Attacking My Server?

#144

Post by YATA0 »

Port knocking, Wireguard, never look back.

You can set an alert for every failed SSH connection because if someone is able to get through that, it's alarming.

This setup has the side effect of reducing your log noise to zero. That SNR is super important for intrusion detection.

Re: Who's Attacking My Server?

#145

Post by dylan604 »

chockchocschoir wrote: post #78
fuzzy2 wrote: post #74

I just ban China entirely from accessing my server. There's nothing on it a Chinese person could be interested in, just personal stuff and a private forum. Doing so has tremendously reduced the overall (remaining) abuse traffic volume. It's quite easy and efficient to do this using IPSet. IP ranges associated with China are available on the net.

Before going about a blocking potential people who are in fact interested in your content/service (which you can't know if they are or not based on the country), did you do the bare minimum to secure your server against attackers from any other location, namely changed from the default password and disabled password login? Your approach to security has a number of issues. First, you don't know if someone is actually…

> I assumed at least semi-public content/service, not private.

Um, they posted information on a public website. It's not private. Even if the site is owned by them, it is publicly available, of their own accord.

Re: Who's Attacking My Server?

#146

Post by aghostincarrot »

fuzzy2 wrote: post #74

I just ban China entirely from accessing my server. There's nothing on it a Chinese person could be interested in, just personal stuff and a private forum. Doing so has tremendously reduced the overall (remaining) abuse traffic volume. It's quite easy and efficient to do this using IPSet. IP ranges associated with China are available on the net.

No post body was provided.

Re: Who's Attacking My Server?

#147

Post by grog454 »

michaelcampbell wrote: post #126
chockchocschoir wrote: post #78

Earlier quoted context omitted.

Before going about a blocking potential people who are in fact interested in your content/service (which you can't know if they are or not based on the country), did you do the bare minimum to secure your server against attackers from any other location, namely changed from the default password and disabled password login? Your approach to security has a number of issues. First, you don't know if someone is actually…

I DO run a "public" service, in that it provides some info to people. However I run it at totally my own cost, the information is for entertainment value only (and not in the "I just say that to get around this being horrible in some way"; it's literally information about gaming and games), and I just don't need the hassle of the constant hack attempts. I block China and Russia, and have for years, using publicly ava…

Honest question: what impact did you see when you switched from not blocking China + Russia to blocking them? What type of attacks are you seeing primarily?

Failed login attempts / brute force attempts seem like the cost of doing business in public. I assume that if my servers are accessible from 1 or more public addresses, they WILL be subject to brute force attempts. I also assume that by making my passwords sufficiently randomized, the probability of these attacks having any effect is infinitesimal.

To me, blocking an IP because it tried to log in to your servers seems purely like a fear response with no rational basis (or at least a poor understanding of probability / stats). By extension, blocking a range of IPs because of some arbitrarily elevated frequency of login attempts seems equally silly.

Now for DOS attacks, temporary IP blocks make perfect sense.

Re: Who's Attacking My Server?

#148

Post by elesiuta »

YATA0 wrote: post #144

Port knocking, Wireguard, never look back. You can set an alert for every failed SSH connection because if someone is able to get through that, it's alarming. This setup has the side effect of reducing your log noise to zero. That SNR is super important for intrusion detection.

I found just using a different port was enough for me and didn't need port knocking to reduce log noise, which I agree is super important.

I also have alerts for both failed SSH or failed wireguard connections, and for any logins from a new IP with either SSH or wireguard.

Re: Who's Attacking My Server?

#149

Post by heap_perms »

mimimi31 wrote: post #44

I once made a very similar visualization to see where people were trying to attack my servers from by adapting (e.g. use local geoip database file instead of ipinfo service) the Python script from [1], which uses folium to generate an interactive (standalone HTML file) heatmap of IP address locations. [1] https://github.com/meesaltena/SSHHeatmap

That's a wonderful project. Amazing, this can be done with just over a hundred lines of code. (excluding packages)

Re: Who's Attacking My Server?

#150

Post by creeble »

bombcar wrote: post #18
Topolomancer wrote: post #11

Earlier quoted context omitted.

Thanks for the reality check, I appreciate it! At least I got a nice map out of this (and made sure that nothing was configured incorrectly, to the best of my knowledge)...

You can get a similar reduction in ssh scans simply by moving the port (and doing nothing else) as the majority of scans only hit port 22. Whether this is worth the hassle is left to the reader: if you have passwords disabled and only use keys it really shouldn’t matter.

In my experience, they find it anyway.

I've run ssh on non-standard ports for over 20 years, and my auth.log is gets a hundred knocks an hour - and mind you, they all return "no key".

It's just life, and it will continue to get worse. Secure your server and ignore it.

Post reply on HN