Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who's Attacking My Server?

bastian.rieck.me

Post reply on HN
Print view View original

161–170 of 231 posts

Re: Who's Attacking My Server?

#161

Post by chockchocschoir »

dylan604 wrote: post #145
chockchocschoir wrote: post #78

Earlier quoted context omitted.

Before going about a blocking potential people who are in fact interested in your content/service (which you can't know if they are or not based on the country), did you do the bare minimum to secure your server against attackers from any other location, namely changed from the default password and disabled password login? Your approach to security has a number of issues. First, you don't know if someone is actually…

> I assumed at least semi-public content/service, not private. Um, they posted information on a public website. It's not private. Even if the site is owned by them, it is publicly available, of their own accord.

"personal stuff" and "private forums" is probably as private as it gets, for being something accessible on the web, and I wouldn't call those publicly available, as you'd need to pass some sort of authorization/authentication to be able to see it. Or I gravely misunderstand your comment.

Re: Who's Attacking My Server?

#162

Post by eptcyka »

tptacek wrote: post #122
chockchocschoir wrote: post #55

Earlier quoted context omitted.

Before complicating the setup even more (by adding more software), I'd opt to make sure I configure the software I already have before going down that route. Removing password login + changing the port would already remove any attack surface and make most scans not finding it at all. And if I'd still be annoyed by the amount of log items at that point, I'd add MAC/IP filtering at the firewall level before getting to…

What exactly are you trying to accomplish with MAC filtering?

Have you not heard of the immensely popular man-between-the-first-hop-attack where hackers physically attach another hop between your server and its gateway?

Re: Who's Attacking My Server?

#163

Post by Eduard »

tptacek wrote: post #119
raggi wrote: post #90

Earlier quoted context omitted.

I've been enough in the SSH code to be somewhat terrified by it. The main server loop has so many nested macro conditionals it's exceptionally difficult to read precisely. That said, fail2ban had an RCE in the last year, so if we're considering trustworthy surfaces, I definitely agree and practice that I trust openssh a whole lot more than a lot of other software that may come up in the discussion.

qmail has one of the most notoriously inscrutable codebases of all time, and it has a startlingly good track record, because there's a coherent security design behind it; the same --- to a greater extent! --- goes for OpenSSH.

Maybe qmail and SSH have their good track record because of security by inscrutability

Re: Who's Attacking My Server?

#164

Post by wila »

hutch120 wrote: post #143

I see these articles a lot, and always wonder why people go it alone. Can anyone link to a discussion about a distributed community run firewall? Does such a thing exist? If so, please comment.

Don't know about "community run firewall", but if you have a few hosts then you can run CSF/LFD in a cluster config.

See for example: https://www.nixtree.com/blog/csf-cluster-setup-for-hosting-c...

Re: Who's Attacking My Server?

#165

Post by amelius »

> As a machine learning researcher, I know that I have different tools at my disposal: I could monitor connections over a prolonged period of time, categorise them as hostile or not, and train a transformer to detect hostile connections in real time. All this would take is a long time for data collection and labelling, followed by a lot of GPU hours.

It's not so simple. You typically need balanced data, which is difficult to obtain since the attacks don't happen very often (hopefully). This is also why anomaly detection is so difficult.

Re: Who's Attacking My Server?

#166

Post by karamanolev »

passivate wrote: post #152
michaelcampbell wrote: post #126

Earlier quoted context omitted.

I DO run a "public" service, in that it provides some info to people. However I run it at totally my own cost, the information is for entertainment value only (and not in the "I just say that to get around this being horrible in some way"; it's literally information about gaming and games), and I just don't need the hassle of the constant hack attempts. I block China and Russia, and have for years, using publicly ava…

Can you really call it a public service if its not accessible to the public? Maybe a "Americas/Europe"-only service, but then it would sound questionable...

I think the commenter wouldn't have any issue calling it an "Americas/Europe"-only service and by his (and arguably, my) logic, it doesn't sound questionable. One has to make choices.

Re: Who's Attacking My Server?

#167

Post by przemub »

ganzuul wrote: post #64
LinuxBender wrote: post #45

Earlier quoted context omitted.

Those are generally for humans defending themselves in life threatening situations. I would suggest talking to a lawyer if you are going this route.

I'm not. I wish to consider if defending one's home might include defending one's electronic presence, however that may manifest itself. For example, you have a home security system that you monitor from your mobile device. Perhaps you have your pet at home, there have been break-ins in your neighborhood, and just after someone showed up on your doorstep the CCTV feed cuts. You are not at home and the cops are busy.…

That's more of a question if protecting your pet's life constitutes a necessary defence in your jurisdiction.

Re: Who's Attacking My Server?

#168

Post by Filligree »

bombcar wrote: post #110
Topolomancer wrote: post #65

Earlier quoted context omitted.

That's an excellent point. I painted myself into a corner here because I am letting some of my friends use the server as well. Have to gently transition them to public key usage only now.

You can restrict password auth to particular users/groups, which also greatly reduces the attack vector.

Or require OTP for password authentication.

Re: Who's Attacking My Server?

#169

Post by tptacek »

eptcyka wrote: post #162
tptacek wrote: post #122

Earlier quoted context omitted.

What exactly are you trying to accomplish with MAC filtering?

Have you not heard of the immensely popular man-between-the-first-hop-attack where hackers physically attach another hop between your server and its gateway?

Even in that joke scenario it doesn't make sense, since those attackers control the MAC layer already.

Re: Who's Attacking My Server?

#170

Post by dspillett »

snek_case wrote: post #158
mimimi31 wrote: post #44

I once made a very similar visualization to see where people were trying to attack my servers from by adapting (e.g. use local geoip database file instead of ipinfo service) the Python script from [1], which uses folium to generate an interactive (standalone HTML file) heatmap of IP address locations. [1] https://github.com/meesaltena/SSHHeatmap

I'm curious what would happen if someone set up a sandbox and let the attackers in. As in curious what commands they would run and what services they would try to install. I'm guessing crypto mining or spam mail?

The problem with a honey trap like that is that the uninteresting events are uninteresting (as you suggest, installing a mail relay, miner, or both, and likely a copy of itself for further spreading), but the interesting ones are unlikely to be fooled unless the honeypot is very clever.

To see anything really interesting you possibly need to let it get far enough that with a good zero-day intend in-hand it may be able to break out and affect the host. I don't know about you, but I don't trust myself to be that clever!

Post reply on HN