101–110 of 124 posts
Earlier quoted context omitted.
Anyone who has run an SSH server on the default port knows that you’ll get hundreds or thousands of login attempts per day. Changing the port to something less obvious and running fail2ban is enough to mitigate most of it. They’re just looking for low hanging fruit.
I just run sslh...
Earlier quoted context omitted.
> given the intentions Exactly. If I just nilly willy connect to your server, try a password and it works and I immediately disconnect, will that get me in trouble in the UK? That would be worrying.
1. mens rea probably applies 2. But if you make a stab at shoplifting and you are successful and give back the item, did you break the law? I am not a lawyer I am just asking.
Well, yeah?
> Upon closer inspection of Asia, we can notice a significant number of addresses located in South Kora, (and possibly North Korea?), as well as in Taiwan. > I was surpised to see that the distribution of attacks is extremely uneven with most of it concentrated in parts of Asia, Europe, and the US, and (almost) none from South America, Middle East, and Russia. Aside from the casual stereotyping of bad actors here, th…
Not seeing how this is stereotyping. He is just presenting his results. Whether those results stem from direct attacks or botnets? He doesn't even speculate. When I ran public servers a few years ago, I saw similar results. Since the company had no customers in Asia, we IP-blocked the entire continent.
I always wondered how the IPs like this 180.101.88.232 from this block: ISP ChinaNet Jiangsu Province Network Domain Name chinatelecom.com.cn Continue to be the source of thousands of ssh password login attempts for years and years on end. It's not a big deal, I use a tarpit on all ssh with 2FA on the one I use, but it seems ridiculous that some participants of the internet don't give a shit about the rest of the wor…
>180.101.88.232 Amusingly I recognize those IPs by that specific prefix as well, basically that entire /24 (at the very least) appears to be an absolutely massive source of the SSH login attempts. Small world, I guess
Basically the entire ASN, they let abusers run wild, and if you look at Cloudflare's stats there's more bot traffic than human traffic!
A lot of the bigger ASNs (unicom, china mobile, etc.) in China are the same, totally unresponsive to abuse reports
Earlier quoted context omitted.
> I use a tarpit on all ssh I would love to hear more about your approach, if that's not sensitive. My Gmail username is the same as my HN username if you prefer. Thank you!
I run an N100 with LXD so I have a container running one of the many ssh tar pits and point 22 and a bunch other ports to it. It simulates an ssh login that very slowly sends ssh banner lines in the connection protocol, endlessly, until they disconnect. It commonly thought that they do nothing, but they seem to keep TCP connections open for quite a long time. A assume a hand written scanning client could detect and m…
I always wondered how the IPs like this 180.101.88.232 from this block: ISP ChinaNet Jiangsu Province Network Domain Name chinatelecom.com.cn Continue to be the source of thousands of ssh password login attempts for years and years on end. It's not a big deal, I use a tarpit on all ssh with 2FA on the one I use, but it seems ridiculous that some participants of the internet don't give a shit about the rest of the wor…
It's not illegal to try to log in to an ssh server. Or many. Apart from that I think the map from the article is mostly matching the number of internet-connected devices per country/region. So I think you can replace "some" by "almost all" in your statement. I mean, find a vulnerable iot device, use it for scanning/botnet.
why is ssh open to the internet to begin with? ufw is the first thing I install, even on a "private" network and here's why. I recently installed a router with IPv4 and IPV6. I later found out that IPv6 was globally addressed with no firewall. Always run ufw and begin by shutting off everything to the internet, then only open up what you need.
Perhaps because the VPS is hosted somewhere remote and (s)he needs to ssh into it. Why ask questions in such an arrogant manner to begin with.
why is ssh open to the internet to begin with? ufw is the first thing I install, even on a "private" network and here's why. I recently installed a router with IPv4 and IPV6. I later found out that IPv6 was globally addressed with no firewall. Always run ufw and begin by shutting off everything to the internet, then only open up what you need.
> I later found out that IPv6 was globally addressed with no firewall. Crazy! What brand router was this? I've never seen an IPv6 capable router configured to permit all traffic by default.
why is ssh open to the internet to begin with? ufw is the first thing I install, even on a "private" network and here's why. I recently installed a router with IPv4 and IPV6. I later found out that IPv6 was globally addressed with no firewall. Always run ufw and begin by shutting off everything to the internet, then only open up what you need.
Hey, a question: I also use ufw because I don't understand firewall rules properly. Is there a benefit for me, a desktop user who would like to set up a tiny home network and possibly setup an SSH server to connect from afar, to delve into iptables/nftables instead? I tried once, but couldn't understand how the rules work. Also, if there is a ground-up explanation of firewall rules, their uses and misuses, and illust…
Here's a good cookbook-style guide on ufw https://www.digitalocean.com/community/tutorials/how-to-set-...
why is ssh open to the internet to begin with? ufw is the first thing I install, even on a "private" network and here's why. I recently installed a router with IPv4 and IPV6. I later found out that IPv6 was globally addressed with no firewall. Always run ufw and begin by shutting off everything to the internet, then only open up what you need.
Erm, because he wanted to use SSH? Using firewall rules on the hosts is like a fake firewall. Stuff on the hosts can override those rules. Like docker. After all, the host is actually receiving the traffic. A router isn't a firewall. Lesson learnt: don't assume any "router" device is also a firewall. Last I heard about half of ISP issued routers don't run any kind of stateful firewall for IPv6. The only reason they d…
the firewall is a kernel config. if configured properly no app can bypass
A router that includes a firewall is a firewall. In my case the firewall was broken.