What SSH Hacking Attempts Look Like • Hacker News Board

Re: What SSH Hacking Attempts Look Like

#11

Post by daenz » Sat, May 05, 2018, 12:06 PM UTC

vbezhenar wrote: post #4

I never understood why people would use fail2ban or similar approaches. Just set proper password and move on. SSH traffic is tiny, it's not a problem. You'll never be hacked with a proper password. Let them waste their time.

I think you mean just use key-based authentication only ;)

Re: What SSH Hacking Attempts Look Like

#12

Post by vuln » Sat, May 05, 2018, 12:16 PM UTC

vbezhenar wrote: post #4

I never understood why people would use fail2ban or similar approaches. Just set proper password and move on. SSH traffic is tiny, it's not a problem. You'll never be hacked with a proper password. Let them waste their time.

Port knocking + key-based auth... What more do you need?

Re: What SSH Hacking Attempts Look Like

#13

Post by lkurusa » Sat, May 05, 2018, 12:24 PM UTC

vuln wrote: post #12

vbezhenar wrote: post #4

I never understood why people would use fail2ban or similar approaches. Just set proper password and move on. SSH traffic is tiny, it's not a problem. You'll never be hacked with a proper password. Let them waste their time.

Port knocking + key-based auth... What more do you need?

What benefit does port knocking add to having a key auth only setup?

Re: What SSH Hacking Attempts Look Like

#14

Post by pm215 » Sat, May 05, 2018, 12:29 PM UTC

vbezhenar wrote: post #4

I never understood why people would use fail2ban or similar approaches. Just set proper password and move on. SSH traffic is tiny, it's not a problem. You'll never be hacked with a proper password. Let them waste their time.

I originally set up fail2ban because I got fed up with the noise of the hard disk going tick...tick...tick every 15 seconds or so, as another password guessing bot login attempt got logged and the disk heads had to seek as the logfile was written out to disk...

Re: What SSH Hacking Attempts Look Like

#15

Post by asmithmd1 » Sat, May 05, 2018, 12:30 PM UTC

lkurusa wrote: post #13

vuln wrote: post #12

Earlier quoted context omitted.

Port knocking + key-based auth... What more do you need?

What benefit does port knocking add to having a key auth only setup?

What benefit does locking the glass doors into a bank add to having time-locked vault? Defense in depth.

Re: What SSH Hacking Attempts Look Like

#16

Post by Artemis2 » Sat, May 05, 2018, 12:37 PM UTC

arca_vorago wrote: post #6

My current take: nftables instead of iptables port-knocking non-standard port key+pass access/auth ip whitelist good logging ED25519 wherever possible!!!

I love the idea of Single-Packet Authorization with fwknop instead of port knocking: http://www.cipherdyne.org/fwknop/

Re: What SSH Hacking Attempts Look Like

#17

Post by kuschku » Sat, May 05, 2018, 12:40 PM UTC

vbezhenar wrote: post #4

I never understood why people would use fail2ban or similar approaches. Just set proper password and move on. SSH traffic is tiny, it's not a problem. You'll never be hacked with a proper password. Let them waste their time.

I have SSH with key auth everywhere, so I have no security worries.

But when sshd ends up pegging an entire core, and I can't login myself anymore, then fail2ban (or even whitelisting IP ranges for ssh) becomes necessary.

Re: What SSH Hacking Attempts Look Like

#18

Post by s3m4j » Sat, May 05, 2018, 12:44 PM UTC

asmithmd1 wrote: post #15

lkurusa wrote: post #13

Earlier quoted context omitted.

What benefit does port knocking add to having a key auth only setup?

What benefit does locking the glass doors into a bank add to having time-locked vault? Defense in depth.

A port knock is just a clear password :/

I much prefer restricting port 22 to a few ip and disable passwords

Re: What SSH Hacking Attempts Look Like

#19

Post by petercooper » Sat, May 05, 2018, 12:59 PM UTC

lkurusa wrote: post #13

vuln wrote: post #12

Earlier quoted context omitted.

Port knocking + key-based auth... What more do you need?

What benefit does port knocking add to having a key auth only setup?

If it's set up properly, it could mean you don't have log files filled with login attempts since the SSH port won't open to them until a successful knock and the knocking doesn't have to be logged.

While port knocking is really just another layer of obscurity, obscurity works really well on scattershot/random attacks. An attacker dedicated to getting into your specific server is another matter but thankfully far more rare.

Re: What SSH Hacking Attempts Look Like

#20

Post by kuschku » Sat, May 05, 2018, 1:04 PM UTC

This all is easy if you only get a handful of login attempts. But when you get more, and more, it becomes an issue. On one of my servers it got so bad that SSH was at the end constantly using an entire CPU core.

I don’t have logs from that server, but here are logs – just the failed attempts – of 2 months from a server that was less severely affected: https://s3.kuschku.de/public/failed_ssh [327M]

And that was despite already blocking massive areas of IP space already.