I like to be able to maintain contact with my servers outside of a few specific ip's - I've locked myself out far too many times when I whitelist a very small number. Anyone have a better workaround for this?
Maybe use spiped[1] if you are worried about ssh security? [1]: https://www.tarsnap.com/spiped.html
I tried it.
I found it harder to use. I even wrote tests for my use cases and what I learned was a real appreciation of what ssh does, is, and provides and I went the other way and use it in more places than I did before.
Port knocking, Wireguard, never look back. You can set an alert for every failed SSH connection because if someone is able to get through that, it's alarming. This setup has the side effect of reducing your log noise to zero. That SNR is super important for intrusion detection.
The folks at OpenBSD Misc do not recommend port knocking. IIRC one of the reasons stated was a possibility of getting locked out of your own server. I tried looking up the relevant thread, but am on the phone.
IPs on the log files most likely are exit proxies if those attackers were not rookies. Simply change the SSH port only would deter 90% of those attempts per my personal experience.
while I'm not the greatest fan of fail2ban ever, though I do use it on some public facing servers, it also has the option for "recidivism" which means that an IP that repeatedly gets itself banned will be banned for an even longer duration, which at least cuts down on the log file clutter somewhat.
You were right about it. I'm currently not using fail2ban and I probably should start using it. Those login failures are nuisance.
I just ban China entirely from accessing my server. There's nothing on it a Chinese person could be interested in, just personal stuff and a private forum. Doing so has tremendously reduced the overall (remaining) abuse traffic volume. It's quite easy and efficient to do this using IPSet. IP ranges associated with China are available on the net.
Before complicating the setup even more (by adding more software), I'd opt to make sure I configure the software I already have before going down that route. Removing password login + changing the port would already remove any attack surface and make most scans not finding it at all. And if I'd still be annoyed by the amount of log items at that point, I'd add MAC/IP filtering at the firewall level before getting to…
I’d say MAC/IP filtering is more annoying in the long term than Wireguard, since I’m not sure I could say that I will 100% never need to access the server unexpectedly from somewhere else. But the ordering before that seem very reasonable. Although Wireguard is a soft alternative to changing default port, so it might be worth doing that. On a slight tangent, I’ve never really bought into changing SSH port from defaul…
Changing the port cut the invalid auths from 1000s a day to 0. Why deal with and log that spam?
Indeed. The author could have spent 15 minutes setting up Tailscale [0] and not expose any listening administration ports to the Internet at all. If they wanted to avoid using a hosted service, Wireguard alone is incredibly defensive against attackers who do not have access to the secret material. Tailscale basically just adds some NAT traversal [1] and OIDC login wrappers. [0]: https://tailscale.com/ [1]: https://ta…
Before complicating the setup even more (by adding more software), I'd opt to make sure I configure the software I already have before going down that route. Removing password login + changing the port would already remove any attack surface and make most scans not finding it at all. And if I'd still be annoyed by the amount of log items at that point, I'd add MAC/IP filtering at the firewall level before getting to…
No need for any kind of MAC filtering: MAC is not propagated outside the L2 broadcast domain, so your server will see only the MAC of the default gateway (the router).
I disagree that IPv6 will be feasible to scan except in unusual circumstances. There might be a case for scanning all of the low ranges ::1 through ::16 or so in the low 2001:: range, but even then you're searching for a rare needle in a haystack. Mass scans become quite impractical.
Usually you perform scans with highly defined IP blocks (at least when you have a target in mind) that are announced by the organizations themselves. Since the ranges are announced publicly, you already have them. Since you have a target in mind, you already have at least one IP. Now take a range that includes that target, and you have a block that has at least one host inside of it. Use masscan that can do 10 millio…
If you're scanning 10 million hosts per second and know the netblock you want to scan it will only take on average a touch under 30,000 years to find the host.
In IPv4 land finding that same host would require scanning a single address.
Port knocking, Wireguard, never look back. You can set an alert for every failed SSH connection because if someone is able to get through that, it's alarming. This setup has the side effect of reducing your log noise to zero. That SNR is super important for intrusion detection.
The folks at OpenBSD Misc do not recommend port knocking. IIRC one of the reasons stated was a possibility of getting locked out of your own server. I tried looking up the relevant thread, but am on the phone.
Linux's firewall can do port knocking entirely in the kernel:
I just ban China entirely from accessing my server. There's nothing on it a Chinese person could be interested in, just personal stuff and a private forum. Doing so has tremendously reduced the overall (remaining) abuse traffic volume. It's quite easy and efficient to do this using IPSet. IP ranges associated with China are available on the net.
Before going about a blocking potential people who are in fact interested in your content/service (which you can't know if they are or not based on the country), did you do the bare minimum to secure your server against attackers from any other location, namely changed from the default password and disabled password login? Your approach to security has a number of issues. First, you don't know if someone is actually…
Not the GP, but every web server I've ever run has had IP addresses originating from China at the top of the frequency list for nefarious attempts to compromise the security. If someone is temporarily visiting China and wants to visit one of my websites, they can wait until they return. I've not removing my blocks on IP addresses.
As a machine learning researcher, I know that I have different tools at my disposal: [...] awk '($(NF-1) = /Ban/){print $NF}' /tmp/fail2ban.log \ | sort \ | jdresolve - \ | uniq -c \ | sort -n -r \ | sed -e 's/^[ \t]*//' \ | sed -e 's/ /\t/' \ | head -n 100 :)