Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who's Attacking My Server?

bastian.rieck.me

Post reply on HN
Print view View original

101–110 of 231 posts

Re: Who's Attacking My Server?

#101

Post by anderspitman »

plufz wrote: post #82
tptacek wrote: post #4

Fail2ban is theater on a properly configured server --- and, increasingly since the mid 2010's, you've had to go out of your way to have a badly configured SSH server. Either way, it's something you have to add specifically to your server, so if you're going to do that, use the same energy to just make sure your server is configured properly. Yeah, yeah, I know it "keeps your logs clean". So does grep, though.

hmm I reason sooner or later a scanner will find an xss/sql exploit/whatever? why give scanners free access to search endlessly for possible exploits when you can fail2ban? all servers have possible exploits if they expose a medium complex service. (if ssh is all you expose and you only allow keys, fine!)

I'm curious, is it common for scanners to look for vulnerabilities in bespoke servers, or do they usually look for known vulnerabilities in specific versions of popular servers like WordPress, Apache, etc?

Re: Who's Attacking My Server?

#102

Post by reaperducer »

fuzzy2 wrote: post #74

I just ban China entirely from accessing my server. There's nothing on it a Chinese person could be interested in, just personal stuff and a private forum. Doing so has tremendously reduced the overall (remaining) abuse traffic volume. It's quite easy and efficient to do this using IPSet. IP ranges associated with China are available on the net.

IP ranges associated with China are available on the net.

Didn't help me all that much.

Most of the abuse and spam leveled at the servers I manage come through $5 DigitalOcean servers being used as relays.

It's the same thing that ruined voice telephony: Make the connection so cheap that it can be abused at scale.

Re: Who's Attacking My Server?

#103

Post by ratorx »

chockchocschoir wrote: post #55
vngzs wrote: post #50

Earlier quoted context omitted.

Indeed. The author could have spent 15 minutes setting up Tailscale [0] and not expose any listening administration ports to the Internet at all. If they wanted to avoid using a hosted service, Wireguard alone is incredibly defensive against attackers who do not have access to the secret material. Tailscale basically just adds some NAT traversal [1] and OIDC login wrappers. [0]: https://tailscale.com/ [1]: https://ta…

Before complicating the setup even more (by adding more software), I'd opt to make sure I configure the software I already have before going down that route. Removing password login + changing the port would already remove any attack surface and make most scans not finding it at all. And if I'd still be annoyed by the amount of log items at that point, I'd add MAC/IP filtering at the firewall level before getting to…

I’d say MAC/IP filtering is more annoying in the long term than Wireguard, since I’m not sure I could say that I will 100% never need to access the server unexpectedly from somewhere else.

But the ordering before that seem very reasonable. Although Wireguard is a soft alternative to changing default port, so it might be worth doing that.

On a slight tangent, I’ve never really bought into changing SSH port from default. I’d say the convenience of not having config/extra port specification is worth having it on a well known port, but that’s just my personal philosophy. I feel like for my low traffic things, just having strong SSH key and auto-updates is good enough.

Re: Who's Attacking My Server?

#104

Post by chockchocschoir »

jandrese wrote: post #100
chockchocschoir wrote: post #52

Earlier quoted context omitted.

While IPv4 in it's entirely is trivial to scan (could do it in ~5 minutes more or less with the right hardware), usually you'd go for ranges to scan instead of the entire space, and IPv6 will still be feasible to scan for ranges, although they become larger.

I disagree that IPv6 will be feasible to scan except in unusual circumstances. There might be a case for scanning all of the low ranges ::1 through ::16 or so in the low 2001:: range, but even then you're searching for a rare needle in a haystack. Mass scans become quite impractical.

Usually you perform scans with highly defined IP blocks (at least when you have a target in mind) that are announced by the organizations themselves. Since the ranges are announced publicly, you already have them. Since you have a target in mind, you already have at least one IP. Now take a range that includes that target, and you have a block that has at least one host inside of it. Use masscan that can do 10 million packets/second (with just one machine) and I'm pretty sure you can feasibly scan IPv6 blocks as well, you just have to get better at targeting and not just wildly target "0.0.0.0/8" (but the IPv6 equivalent).

Moreover, you can scan for one common port inside a block (like 22, 80, 443 or whatever) which means you can cover wider blocks, and for the hosts you find, run a scan covering a bigger range of ports. Again, improve the targeting and IPv6 won't stop you either.

Re: Who's Attacking My Server?

#105

Post by jcynix »

71a54xd wrote: post #41
taf2 wrote: post #35

Earlier quoted context omitted.

You should just not allow any IP to access your server to begin with… have a list of trusted IPs - this and only allow public / private key access with a second factor device and I think you should be good…

I like to be able to maintain contact with my servers outside of a few specific ip's - I've locked myself out far too many times when I whitelist a very small number. Anyone have a better workaround for this?

During holiday trips, where I might need to access a server from anywhere, I use a list of one time passwords (more or less just a bunch of md5sums) which I can send to a server on https, which then adds the requesting ip address to /etc/hosts.allow for a limited time. This ip address will be able to connect via ssh (still secured with a key) then for that time.

Re: Who's Attacking My Server?

#106

Post by LinuxBender »

ganzuul wrote: post #64
LinuxBender wrote: post #45

Earlier quoted context omitted.

Those are generally for humans defending themselves in life threatening situations. I would suggest talking to a lawyer if you are going this route.

I'm not. I wish to consider if defending one's home might include defending one's electronic presence, however that may manifest itself. For example, you have a home security system that you monitor from your mobile device. Perhaps you have your pet at home, there have been break-ins in your neighborhood, and just after someone showed up on your doorstep the CCTV feed cuts. You are not at home and the cops are busy.…

I totally get the idea and I agree with the intent.

There are some places that allow defending a home using automation using non lethal force but even that comes with some risk of civil legal issues. This is why I suggest consulting with a lawyer. Even with non lethal means one would want to ensure it is legal in their location and that they have the proper signs with appropriate verbiage and mitigating controls in place first. Also understanding what laws are enforced and how they are enforced in your particular area is useful. My own personal solution was to move to a location that supports your idea and the Sheriff would likely high-five me if I take out the trash. There are trade-offs of course and hopefully such things are never required.

There was talk at one point of creating laws that supported counter-hacking but those never happened and it is highly unlikely they would ever pass. Proper attribution is hard enough. There are endless rabbit holes of problems such laws would create. At a minimum there would be a vastly increased requirement on everyone's part to increase audit trails and data storage alone would become a booming business, far more than it already is.

Re: Who's Attacking My Server?

#107

Post by dym_sh »

Topolomancer wrote: post #80
fuzzy2 wrote: post #74

I just ban China entirely from accessing my server. There's nothing on it a Chinese person could be interested in, just personal stuff and a private forum. Doing so has tremendously reduced the overall (remaining) abuse traffic volume. It's quite easy and efficient to do this using IPSet. IP ranges associated with China are available on the net.

Not an option for me, but thanks for the suggestion. I don't want to erect a geo-fence here.

chinese goverment already did that for you. anyone who really needs to access you site from inside china will use vpn or tor.

Re: Who's Attacking My Server?

#108

Post by bombcar »

anderspitman wrote: post #101
plufz wrote: post #82

Earlier quoted context omitted.

hmm I reason sooner or later a scanner will find an xss/sql exploit/whatever? why give scanners free access to search endlessly for possible exploits when you can fail2ban? all servers have possible exploits if they expose a medium complex service. (if ssh is all you expose and you only allow keys, fine!)

I'm curious, is it common for scanners to look for vulnerabilities in bespoke servers, or do they usually look for known vulnerabilities in specific versions of popular servers like WordPress, Apache, etc?

They’re almost always looking for known vulnerabilities dumbly - you’ll see one IP try fifteen-fifty different URL based attacks.

Re: Who's Attacking My Server?

#109

Post by judge2020 »

mistrial9 wrote: post #25
Topolomancer wrote: post #3

Earlier quoted context omitted.

Good point; there used to be some issues with this since my dad is an interpreter for Russian, so we used to have some legitimate business there (probably not relevant, but his clients would essentially come to Europe to be trained in certain medical equipment)...but recent events might probably force early retirement for him. Somewhat unrelated: I have noticed that SPAM from Russian servers stopped on Feb 23 right b…

does anyone here recognize the difference between civilians and participants in armed conflict? medical in particular, right?

armies are only supported by the industry and economy created by the civilians.

Re: Who's Attacking My Server?

#110

Post by bombcar »

Topolomancer wrote: post #65
fabian2k wrote: post #20

Earlier quoted context omitted.

For SSH simply disallowing passwords entirely removes this problem. For me that's the one single thing that dramatically improves defense against any kind of brute force or untargeted attack.

That's an excellent point. I painted myself into a corner here because I am letting some of my friends use the server as well. Have to gently transition them to public key usage only now.

You can restrict password auth to particular users/groups, which also greatly reduces the attack vector.
Post reply on HN