Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Large scale Internet SSH brute force attacks seem to have stopped here

utcc.utoronto.ca

Post reply on HN
Print view View original

121–127 of 127 posts

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#121

Post by klausagnoletti »

gingerlime wrote: post #50
nousermane wrote: post #34

Earlier quoted context omitted.

Honestly, I don't understand why people make reporting abuse so hard/labour-intensive. It is trivial to record netflow data (and most networks do that already), and then verify incoming abuse reports against those records.

is there a chance of forming some kind of a community fail2ban blocklist? I guess trusting the contributors and admins is the hard part here and that’s why spam lists are a double edged sword?

As someone else mentions, CrowdSec can do just that. It's FOSS and can act as a modern Fail2Ban replacement that can detect all sorts of attacks - in this case ssh bruteforce/slow brute force attacks - and shares very basic information about those attacks (source ip, timestamp, which attack) with everyone else. So in that way everybody using CrowdSec are helping each other out. More information at https://crowdsec.net. Disclaimer: I am head of community at CrowdSec so feel free to ask me any questions you may have here or join our Discord at https://dicord.gg/crowdsec.

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#122

Post by rsync »

exabrial wrote: post #68

We have take the approach that the only ports visible to internet traffic are un-authenticated ones... everything else must traverse ipsec or wireguard. This gives us completely silent ssh ports. We found strongswan examples pretty useful... it's basically pick your config and copy/paste. Wireguard only has 'one way' to set it up which is a whole 'nother level of simplicity. This has completely silenced our firewall…

Alternatively, you can hide your ssh port behind port knocking… which I find to be simple and elegant - and requires almost no configuration or tooling.

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#124

Post by ficklepickle »

_iven_ wrote: post #65
_wldu wrote: post #39

I still see them. They come and go, but are always present at some level. 2022-08-29T17:35:12.617Z [DEBUG] sshlog gen 113.61.219.237 admin admin SSH-2.0-HELLOWORLD 2022-08-29T17:48:17.879Z [DEBUG] sshlog gen 218.92.0.190 root poohbear SSH-2.0-PUTTY 2022-08-29T17:48:18.041Z [DEBUG] sshlog gen 218.92.0.190 root p@ssw0rd3 SSH-2.0-PUTTY 2022-08-29T17:48:18.2Z [DEBUG] sshlog gen 218.92.0.190 root p@ssword! SSH-2.0-PUTTY 2…

May I ask how to configure the sshd to generate logs like yours? I searched for it and could not find much information.

It's called sshlog. It's a patch that logs username/password.

https://github.com/62726164/sshlog

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#125

Post by gingerlime »

klausagnoletti wrote: post #121
gingerlime wrote: post #50

Earlier quoted context omitted.

is there a chance of forming some kind of a community fail2ban blocklist? I guess trusting the contributors and admins is the hard part here and that’s why spam lists are a double edged sword?

As someone else mentions, CrowdSec can do just that. It's FOSS and can act as a modern Fail2Ban replacement that can detect all sorts of attacks - in this case ssh bruteforce/slow brute force attacks - and shares very basic information about those attacks (source ip, timestamp, which attack) with everyone else. So in that way everybody using CrowdSec are helping each other out. More information at https://crowdsec.ne…

Thank you! super cool! how do you solve the trust issue? (e.g. someone reporting their competitor ips as attackers, or whitelisting false positives/appeals)

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#127

Post by _iven_ »

ficklepickle wrote: post #124
_iven_ wrote: post #65

Earlier quoted context omitted.

May I ask how to configure the sshd to generate logs like yours? I searched for it and could not find much information.

It's called sshlog. It's a patch that logs username/password. https://github.com/62726164/sshlog

Thank you very much for the kind reply. I will try it out on one of my vps servers. Looking to have some fun when performing analysis afterwards. Thanks!
Post reply on HN