Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who's Attacking My Server?

bastian.rieck.me

Post reply on HN
Print view View original

181–190 of 231 posts

Re: Who's Attacking My Server?

#181

Post by nkozyra »

criddell wrote: post #84
chockchocschoir wrote: post #78

Earlier quoted context omitted.

Before going about a blocking potential people who are in fact interested in your content/service (which you can't know if they are or not based on the country), did you do the bare minimum to secure your server against attackers from any other location, namely changed from the default password and disabled password login? Your approach to security has a number of issues. First, you don't know if someone is actually…

I don't think it matters if the geo-location table is correct or not. If traffic from an IP range is entirely malicious, block that IP range. If that range happens to be Chinese or from Florida it doesn't really matter, does it?

Most of the time these malicious attacks will come from a data center, where someone is no doubt leasing some hardware until they get shut down.

When I get any number of malicious known attack vectors, I have a process that runs a few services against the IP for geolocation and server info. If it's a known data center, its block is immediately blocked, otherwise just the IP.

For whatever reason, they tend not to get new ips easily, so shutting down the IP will usually buy a few days before they have a new instance on qualys or whatever.

Re: Who's Attacking My Server?

#182

Post by raegis »

holoduke wrote: post #131
walrus01 wrote: post #127

Earlier quoted context omitted.

this seems to presume that malicious things originating in china scanning/probing other peoples' IP ranges don't use proxies or rented VMs, or relay compromised hosts almost anywhere in the world, etc. all that banning chinese /16 or /12 size netblocks will do is cut down on the clutter in your logs, not actually accomplish anything. getting scanned and probed by peoples' automated tools looking for vulnerabel daemon…

Totally agree. Sometimes I watch my live logs of auth.log of about 100 public servers. I am probably see 10 port scans or ssh attempts per second from random machines. Nothing to worry about if machines setup correctly. More worrying are the people who try to break our public APIs. Either by letting it to crash, brute force operations etc. The security flaws are often inside the software domain layer.

Wow. I'm looking at only one of my servers and there is a root login attempt every second. I feel a little embarrassed I am surprised by this.

Re: Who's Attacking My Server?

#183

Post by nerdyadventurer »

37ef_ced3 wrote: post #6

Anecdotally, I run a several servers hosting several websites and several Android app back-ends. Every few weeks they are attacked: 12 hours of attempted logins, port scanning, etc. It's perfectly normal and nothing new.

What are best practices to secure back-end services, websites? Any good resources on the topic

Re: Who's Attacking My Server?

#184

Post by namibj »

Topolomancer wrote: post #65
fabian2k wrote: post #20

Earlier quoted context omitted.

For SSH simply disallowing passwords entirely removes this problem. For me that's the one single thing that dramatically improves defense against any kind of brute force or untargeted attack.

That's an excellent point. I painted myself into a corner here because I am letting some of my friends use the server as well. Have to gently transition them to public key usage only now.

Give them a reasonable deadline, and just disable password login afterwards.

This isn't something they should have trouble understanding/accepting.

Re: Who's Attacking My Server?

#185

Post by rdtsc »

fuzzy2 wrote: post #74

I just ban China entirely from accessing my server. There's nothing on it a Chinese person could be interested in, just personal stuff and a private forum. Doing so has tremendously reduced the overall (remaining) abuse traffic volume. It's quite easy and efficient to do this using IPSet. IP ranges associated with China are available on the net.

I did the same thing - blocked China, then moved the SSH login to another port. It cut down some log noise which was good enough for us.

Re: Who's Attacking My Server?

#186

Post by randomtwiddler »

rascul wrote: post #70
matja wrote: post #49

Earlier quoted context omitted.

If fail2ban is theater, so is a firewall, so is SELinux, so are filesystem permissions (a properly configured process would only read/write the files it's supposed to, right?). If an remote vuln needs some stack-smashing technique that has a low probability of success, fail2ban is going to to slow that down - perhaps in a way that makes it more obvious in logs, buying you time to discover your broken configuration or…

I believe the implication is that a properly configured server isn't going to allow passwords, and fail2ban isn't much more than a log size reducer when passwords aren't allowed.

I'm all about reducing the noise in log files.

I've had three production servers go down for various clients and the primary reason was full disk, primarily due to log files.

Re: Who's Attacking My Server?

#187

Post by 71a54xd »

jcynix wrote: post #105
71a54xd wrote: post #41

Earlier quoted context omitted.

I like to be able to maintain contact with my servers outside of a few specific ip's - I've locked myself out far too many times when I whitelist a very small number. Anyone have a better workaround for this?

During holiday trips, where I might need to access a server from anywhere, I use a list of one time passwords (more or less just a bunch of md5sums) which I can send to a server on https, which then adds the requesting ip address to /etc/hosts.allow for a limited time. This ip address will be able to connect via ssh (still secured with a key) then for that time.

This is a really cool idea! I've also toyed with a similar approach of watching ssh logs within very specific time windows and providing a one time key in order to temporarily add another SSH key which I can use to recover the server.

Probably a bit overkill - but it was a fun feature to implement with Go over the weekend. The new Fido2 SSH implementation is also incredibly cool.

Re: Who's Attacking My Server?

#188

Post by walrus01 »

mrjin wrote: post #172
walrus01 wrote: post #127

Earlier quoted context omitted.

this seems to presume that malicious things originating in china scanning/probing other peoples' IP ranges don't use proxies or rented VMs, or relay compromised hosts almost anywhere in the world, etc. all that banning chinese /16 or /12 size netblocks will do is cut down on the clutter in your logs, not actually accomplish anything. getting scanned and probed by peoples' automated tools looking for vulnerabel daemon…

IPs on the log files most likely are exit proxies if those attackers were not rookies. Simply change the SSH port only would deter 90% of those attempts per my personal experience.

while I'm not the greatest fan of fail2ban ever, though I do use it on some public facing servers, it also has the option for "recidivism" which means that an IP that repeatedly gets itself banned will be banned for an even longer duration, which at least cuts down on the log file clutter somewhat.

Re: Who's Attacking My Server?

#189

Post by kazinator »

As a machine learning researcher, I know that I have different tools at my disposal:

[...]

  awk '($(NF-1) = /Ban/){print $NF}' /tmp/fail2ban.log \
  | sort                                             \
  | jdresolve -                                      \
  | uniq -c                                          \
  | sort -n -r                                       \
  | sed -e 's/^[ \t]*//'                             \
  | sed -e 's/ /\t/'                                 \
  | head -n 100
:)

Re: Who's Attacking My Server?

#190

Post by teleforce »

fuzzy2 wrote: post #74

I just ban China entirely from accessing my server. There's nothing on it a Chinese person could be interested in, just personal stuff and a private forum. Doing so has tremendously reduced the overall (remaining) abuse traffic volume. It's quite easy and efficient to do this using IPSet. IP ranges associated with China are available on the net.

Please check this very interesting real-time Live Threat Map by Radware [1].

Most of these attacks are harmless and the attacks that you should be worried is the Advanced Persistent Threat (APT) types [2].

Around eight years back I've proposed a system for crowdsourcing in covertly detecting APT similar to the minefields concept being used in war and I still think it's the best way to reliably detect APT including zero-day attacks.

Few months back in HN someone proposed an open source solution for crowdsourcing firewall, IDS and IPS but cannot get the link for now on top of my head at the moment.

[1] Live Threat Map:

https://livethreatmap.radware.com/

[2] Advanced Persistent Trap:

https://en.wikipedia.org/wiki/Advanced_persistent_threat

Post reply on HN