Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What SSH Hacking Attempts Look Like

medium.com

Post reply on HN
Print view View original

111–120 of 186 posts

Re: What SSH Hacking Attempts Look Like

#111

Post by tonyarkles »

teddyh wrote: post #102
gregmac wrote: post #80

Earlier quoted context omitted.

(I'm primarly a developer, not sysadmin) Is using non standard ports a reasonable approach? On one hand, it's kind of a security-by-obscurity measure, and it's also a (very minor) inconvenience to real users. However if it's not being used in place of other reasonable security measures, I'm not really sure what's bad about it, but it does feel a bit janky to me. Same goes for other non-public services such as VPN. Wh…

> I'm not really sure what's bad about it You say it yourself: > also a (very minor) inconvenience to real users I would disagree with the “very minor” part. To paraphrase myself ( https://news.ycombinator.com/item?id=6617312 ): As I understand the argument, it’s “Changing port number add security, therefore it’s a good idea.” I think nobody argues that it adds security . The problem is that: 1. It adds very little s…

You know what it does do though? Dramatically reduces the amount of log spam :). Running SSH on port 22 vs. even just 2222 significantly reduces the number of failed login attempt messages. They'd always fail anyway unless they happened to somehow get ahold of my ssh private key, but it's sure a lot less annoying when looking for something in the logs to not have to filter through all that noise.

Re: What SSH Hacking Attempts Look Like

#112

Post by rsync »

tempfs wrote: post #88

Some notes from an InfoSec person. - Have a stand alone SSH server that is something like a R-Pi[type B] running an OS that gets patches regularly via unattended-upgrades and reboots itself at least once a week.[could also be a minimal VM like AlpineOS if you need Gbps+ line speed] - Have this R-Pi and your network gear plugged into a UPS that can withstand at least a couple of hours of power outage. - Use non-standa…

"Others have mentioned port-knocking which is a cool trick but not something that I typically use in an actual daily defense strategy because I'm not sure how much value it really adds."

I don't know how much it adds, but it is non-zero.

The knockd daemon is rock solid[1] and your ssh port traffic goes down to zero (other than your own use).

Port knocking has no place in security by itself but I think it's a wonderful addition to a layered defense - my favorite one, in fact.

Re: What SSH Hacking Attempts Look Like

#113

Post by marcosdumay »

simias wrote: post #97
gsich wrote: post #52

Changing the SSH port proved to be most successful. Yes, of course you can find the port with a port scan. But it keeps the logs clean. And I don't want to waste CPU cycles on some brute-forcing idiots.

Years ago (actually probably more than 10 years ago now) I actually switched from port 22 to 622 on my server because I wanted to get rid of the noise of people attempting to bruteforce my SSH regularly. It worked perfectly for years but surprisingly I've had a handful of bruteforce attempts on port 622 in the past year or so. Nothing particularly targeted either, always the same typical default users (root, admin, o…

> I wonder who bothers doing that.

Somebody that added nmap to their bot script.

Re: What SSH Hacking Attempts Look Like

#114

Post by rsync »

petercooper wrote: post #19
lkurusa wrote: post #13

Earlier quoted context omitted.

What benefit does port knocking add to having a key auth only setup?

If it's set up properly, it could mean you don't have log files filled with login attempts since the SSH port won't open to them until a successful knock and the knocking doesn't have to be logged. While port knocking is really just another layer of obscurity, obscurity works really well on scattershot/random attacks. An attacker dedicated to getting into your specific server is another matter but thankfully far more…

"While port knocking is really just another layer of obscurity, obscurity works really well on scattershot/random attacks."

Thank you. Remember - security through only obscurity is a bad idea, but additional layers of obscurity can be very valuable.

Also remember: a typical port knock is a series of three ports that all have to be hit in a certain timeframe - for instance, 2000, 4000, 8000 - that's a big "keyspace" to brute force through at WAN packet speeds ...

Re: What SSH Hacking Attempts Look Like

#115

Post by gregmac »

munin wrote: post #87
xur17 wrote: post #85

Earlier quoted context omitted.

I typically just pick a high numbered port. > 10k would work. I see it as a way to reduce the number of attacks, which is helpful, and may end up being more secure, but I wouldn't count on that alone. Against botnet attacks it will likely help, but against someone specifically targeting you, it likely will only slow them down. Basically it boils down to 'why not?' for me.

A high numbered port (above 1024) can be bound by non root programs. Use some non 22 port below 1024 if you want to change the port. Or use some RBAC system like selinux to keep anyone from binding to 2222 or whatever.

Awesome point, and exactly the advice I was looking for.

Re: What SSH Hacking Attempts Look Like

#116

Post by rsync »

s3m4j wrote: post #18
asmithmd1 wrote: post #15

Earlier quoted context omitted.

What benefit does locking the glass doors into a bank add to having time-locked vault? Defense in depth.

A port knock is just a clear password :/ I much prefer restricting port 22 to a few ip and disable passwords

"A port knock is just a clear password"

It is only clear to the routers in your traceroute ... third party attackers cannot snoop on this traffic.

Re: What SSH Hacking Attempts Look Like

#117

Post by sametmax »

jgtrosh wrote: post #54
gsich wrote: post #51

Earlier quoted context omitted.

Which is worse then using cat, from a user perspective. Imagine if you look for something else, you have to point the cursor in the middle, right after grep and before the file. With cat |grep you press Arrow-up and Alt+Backspace and you are right where you want to be, ready to search for something else. In scripts you can save the extra process though.

You mean ctrl-w or bC? ;-) I would find it okay without cat to start the next line with "grep newPattern " and then fetching the previous filename with alt-. (edit: or !$ of course, but alt-. is more practical) -- not saying it's necessarily always better, but knowing your shell better (and/or using a better one) is often a viable alternative to using another construct. Also, than* (sorry)

Ctrl + W close the current view in a lot of software. Dangerous shortcut to get used to.

Re: What SSH Hacking Attempts Look Like

#118

Post by fencepost »

zAy0LfpBZLC8mAC wrote: post #53
znpy wrote: post #46

I am slowly closing all non-vital ports on my router and just letting services accessible from within the VPN. No open port = no hacking attempts. Investing a week of on-and-off studying and tinkering with openvpn is really paying off.

> No open port = no hacking attempts. That's just obviously nonsense? Closing the port does not change anything about the attempts. Nor about the success rate of the attempts, if you aren't being an idiot with insecure passwords.

Closing the port does not change anything about the attempts. Nor about the success rate of the attempts, if you aren't being an idiot with insecure passwords.

How about "No open port = no concern about possibly vulnerable services running on open ports"? I actually worry less about passwords and more about overflows, protocol problems and parse errors these days.

Re: What SSH Hacking Attempts Look Like

#119

Post by akira2501 »

rsync wrote: post #112
tempfs wrote: post #88

Some notes from an InfoSec person. - Have a stand alone SSH server that is something like a R-Pi[type B] running an OS that gets patches regularly via unattended-upgrades and reboots itself at least once a week.[could also be a minimal VM like AlpineOS if you need Gbps+ line speed] - Have this R-Pi and your network gear plugged into a UPS that can withstand at least a couple of hours of power outage. - Use non-standa…

"Others have mentioned port-knocking which is a cool trick but not something that I typically use in an actual daily defense strategy because I'm not sure how much value it really adds." I don't know how much it adds, but it is non-zero. The knockd daemon is rock solid[1] and your ssh port traffic goes down to zero (other than your own use). Port knocking has no place in security by itself but I think it's a wonderfu…

I just use the firewall.. if you make more than 4 SSH connections inside of a minute you're blackholed for 5 minutes. Pretty much drops all automated scanners right on the floor while not adding any steps for normal use.

Re: What SSH Hacking Attempts Look Like

#120

Post by MaupitiBlue »

dingaling wrote: post #108
gsich wrote: post #52

Changing the SSH port proved to be most successful. Yes, of course you can find the port with a port scan. But it keeps the logs clean. And I don't want to waste CPU cycles on some brute-forcing idiots.

I have my perimeter sshd on port 22... Only bound to IPv6 It's a big quiet void out there in sixspace.

As I sit here wasting a beautiful a Saturday afternoon trying to secure my ssh and openvpn setup, your post makes me wonder if maybe it's time ...
Post reply on HN