Would be cool to see brute.success
Brute.Fail: Watch brute force attacks fail in real time
191–200 of 268 posts
Re: Brute.Fail: Watch brute force attacks fail in real time
#192I put on my firewall a block for incoming traffic for all IPs outside Europe which helped a lot with the quantity of attempts.
is it possible? how did you filter?
(I've tried 2 years ago: at that time even aws is not able to provide a reliable EU ip list)
Re: Brute.Fail: Watch brute force attacks fail in real time
#193Earlier quoted context omitted.
If your SSH key leaks you're not going to have a warning. All you'll see is a login from yourself that you don't remember. I am pretty sure we turned off password authentication like 10 posts up this thread.
This is why I require both a private key and a password. I have fail2ban configured to block IPs with invalid private keys after a couple attempts, and if the key is valid to email me and rate limit invalid password attempts. This gives a more than sufficient warning if my key leaks which is already very unlikely, and this just makes it much more unlikely for both to be compromised, and only took an extra 5 minutes t…
How do you configure emails on successful logins? Can you share your config, sufficiently anonymized?
Re: Brute.Fail: Watch brute force attacks fail in real time
#194This site is now brought down due to the collective brute forcing of HNers visiting the site, as if akin to a DDOS. How ironic.
I've seen people call this the "Hug of death" when your post gets so popular the site goes down
Re: Brute.Fail: Watch brute force attacks fail in real time
#195[deleted]
Re: Brute.Fail: Watch brute force attacks fail in real time
#196If this doesn't get to install fail2ban don't know what will.
I was actually thinking about that: OT1H, fail2ban would really clean up the list, so it's not monopolized by the one joker, but OTOH given sufficient spans of time it would make the output go quiet, which for this specific case defeats the purpose I actually much prefer the projects that give the caller a fake shell, and watch what they type after "breaking in." It'd be the Kitboga of ssh attacks :-D
> give the caller a fake shell, and watch what they type after "breaking in."
Oh YES! Do it, please! We could learn a lot!
Re: Brute.Fail: Watch brute force attacks fail in real time
#197That’s neat. What’s the total volume per day? Are the passwords themselves being escaped in the final UI rendering? Otherwise you’d have an XSS for a password like “ /* code */ ". EDIT: Unless it's happening on the server side where it's being saved, I don't think they're being escaped: col1.innerHTML = ' ' + msg.src; col2.innerHTML = msg.proto; col3.innerHTML = ' ' + msg.u + ' '; col4.innerHTML = ' ' + msg.p + ' ';
It is escaped server side. Anything long enough to be a useful payload is trimmed.
As the other comment said, just write proper code instead of going "oh but it's escaped and size-limited."
JS has sane APIs where no string is "dangerous," use them.
Re: Brute.Fail: Watch brute force attacks fail in real time
#198Earlier quoted context omitted.
Try negotiating ssh compression and then sending terabytes of compressed zeroes. Might work for a badly implemented scanner.
Semi-related, I've just started serving large files to webserver scanners, some are so poorly made that they just download the entire file
Please tell me it's a massively upscaled hello.jpg you send...
Re: Brute.Fail: Watch brute force attacks fail in real time
#199For this reason I've put `endlessh` on port 22 and moved actual ssh elsewhere... Also started using Crowdsec recently, but not sure about if it's worth it... fail2ban out of the box works fine for SSH, but for dovecot and postfix it's somehow broken, and the configuration scripts are just too obtuse.
Do the dovecot and postfix scenarios work well for you with crowdsec? Always like hearing user stories :)