Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AS13335 doing SSH scanning

encryp.ch

Post reply on HN
Print view View original

101–110 of 110 posts

Re: AS13335 doing SSH scanning

#101

Post by seized »

LinuxBender wrote: post #33

This is not unique to Cloudflare, Level3 or any of the other networks I've seen mentioned in this thread. The entire internet scans all the common ports and this should be expected to continue indefinitely. If this is causing alerts from your logging, there are a few options: - Implement a firewall on your instances. - Implement port knocking for sshd. - Move sshd to a non standard port to avoid the nmap/bot noise. -…

Or Fail2Ban. I have mine setup so that it does an API call to my OPNSense firewall. A few wrong logins to my self hosted things (SSH included) and that IP is permanently blocked from everything.

Re: AS13335 doing SSH scanning

#103

Post by zinekeller »

TechBro8615 wrote: post #96
zinekeller wrote: post #19

Update: they apparently also have a paid product called "Cloudflare for Teams", which also uses the same infrastructure and are targeted for companies. Probably the reason they don't block out SSH is that companies do want SSH access - but I'm pretty sure that RDP access would be higher on the list. My friend working in an ISP has cleared the mystery for me - it's Cloudflare's Warp product (a semi-VPN (in the "telepo…

FYI the WARP VPN is _not anonymizing_ and doesn’t claim to be. If you connect through WARP to a website behind Cloudflare, they will include your real IP in a header. The main point of WARP is to circumvent ISP traffic shaping (which works quite well btw).

I mean, I just learned about Warp because of this, so if there are misunderstandings that my friend didn't think to clarify (probably because she thought that I already knew Warp), then apologies. The HN edit clock has since been long-expired, so I cannot add corrections about this.

Re: AS13335 doing SSH scanning

#104

Post by zinekeller »

sudobash1 wrote: post #69
zinekeller wrote: post #24

Earlier quoted context omitted.

Not to disappoint you, but except for logging SSH honeypots are becoming useless (most bots automatically disconnect when they detect a long login banner).

So should I add a long banner to my server to disguise it as a honey pot, just in case?

I mean, I'm not sure that you can do that with OpenSSH though (short of recompiling it, which I do not recommend unless you're a company).

Re: AS13335 doing SSH scanning

#105

Post by cpach »

nousermane wrote: post #51
nickdothutton wrote: post #38

Just use something like fail2ban to drop these at the packet filter level, either courtesy of your cloud provider or on the host itself. Make sure your sshd config is watertight.

Are there reputable places where people can share the IPs tripping fail2ban? Like spamhaus.org, but for scanners?

Honest question: Why bother?

Re: AS13335 doing SSH scanning

#106

Post by sleepybrett »

marginalia_nu wrote: post #55
brohee wrote: post #9

Earlier quoted context omitted.

What kind of answer would you expect, in all seriousness? The thing you are reporting is not illegal or even dodgy.

VPS and VPN providers should be very mindful of their reputation in this regard. If they get a reputation as a "black hole" where complaints vanish and nothing ever happens, the effect may be that other customers start to find themselves blocked or throttled on a subnet level.

https://twitter.com/IamRageSparkle/status/128089153745134387...

Re: AS13335 doing SSH scanning

#107

Post by sleepybrett »

eli wrote: post #74
marginalia_nu wrote: post #55

Earlier quoted context omitted.

VPS and VPN providers should be very mindful of their reputation in this regard. If they get a reputation as a "black hole" where complaints vanish and nothing ever happens, the effect may be that other customers start to find themselves blocked or throttled on a subnet level.

I don’t know of any provider that would take action on reports of ssh scanning.

I report them from time to time. I'm not sure why people don't take them seriously. If 500 people a day came up to your front door and tried the knob, hell maybe even tried a couple of keys in the lock... I'm pretty sure you'd be calling the cops.

Re: AS13335 doing SSH scanning

#108

Post by giantrobot »

ronsor wrote: post #102
giantrobot wrote: post #72

So...drop 8.0.0.0/8 traffic and move on? Port scans happen all the time, some are malicious and others not.

I don't think dropping traffic from roughly 1/200th of public IP space is a real solution.

Isn't it? If you don't need to accept SSH traffic from that block you can just drop it.

Re: AS13335 doing SSH scanning

#109

Post by sm_javaarchive »

sammy2244 wrote: post #14

Cloudflare warp is essentially a free vpn, this is going to happen. Iirc they use completely separate subnets for this so you can filter it/block it. Ip starts with 8. Something

Yep, if the site you're accessing is not on the cloudflare network, they'll see an ip starting with 8.

Re: AS13335 doing SSH scanning

#110

Post by eli »

sleepybrett wrote: post #107
eli wrote: post #74

Earlier quoted context omitted.

I don’t know of any provider that would take action on reports of ssh scanning.

I report them from time to time. I'm not sure why people don't take them seriously. If 500 people a day came up to your front door and tried the knob, hell maybe even tried a couple of keys in the lock... I'm pretty sure you'd be calling the cops.

An ssh server isn’t really like a front door though. I don’t necessarily think attempting a random ssh server should be a crime.

I used to spend time on custom iptables scripts but came to the conclusion it’s much better to just architect things in a way where the bots and scanners can’t plausibly create a problem and then ignoring them.

Post reply on HN