121–130 of 268 posts
Some of these credentials could be of legitime users who have just mistyped the IP address.
No legitimate services are offered on the addresses receiving these attempts, so there is no chance of a real user accidently submitting their credentials. (Yes things other than SSH occasionally show up)
Earlier quoted context omitted.
This. I really do not understand why people use fail2ban when the threat is somewhere else. It won't stop a ddos but will certainly, at some point, prevent you from logging in.
> This. I really do not understand why people use fail2ban when the threat is somewhere else. Fail2ban keeps my log short enough that I can review them daily, I don't have to sift through thousands of login attempt. > It won't stop a ddos but will certainly, at some point, prevent you from logging in. Yup, losing my key and having no password access will do that.
Earlier quoted context omitted.
This, and move the endpoint on an uninteresting port to lower the noise in the logs
... and avoid automated attacks in case a 0-day in the pre-authentication OpenSSH server code shows up
So funny story, for a while I worked on a 'reverse' exploit. Which is to say morphing the response from ssh to the client with large malformed packets. The idea was to crash the client making the request. In my case I found these attacks would have like 6 to 10 attempts from the same source address. By time stamping the requests, I could evaluate if the next attack from the same address came more quickly or more slow…
Disable password authentication and fail2ban becomes completely unnecessary.
I put on my firewall a block for incoming traffic for all IPs outside Europe which helped a lot with the quantity of attempts.
What about an actual user fat-fingering their username but entering their password correctly? Would this publish that attempt publicly?
> No legitimate services are offered on the addresses receiving these attempts, so there is no chance of a real user accidently submitting their credentials.
This is amazing! Are you open sourcing this? Can others stream their logs to your servers and have a crowdsourced list of attackers in real time together with their activity?
See abuseipdb.com if you care about this.
Wish the ISPs would subscribe to this and blocked traffic from the abusive IPs in their networks
Clicked on a random IP on the front page, it said it’s from Palo Alto Networks in Santa Clara, that it was first reported in 2022 and the last report was 5min ago. So that IP has been doing shady stuff for months and it seems their ISP (Palo Alto Networks) doesn’t really care
That’s neat. What’s the total volume per day? Are the passwords themselves being escaped in the final UI rendering? Otherwise you’d have an XSS for a password like “ /* code */ ". EDIT: Unless it's happening on the server side where it's being saved, I don't think they're being escaped: col1.innerHTML = ' ' + msg.src; col2.innerHTML = msg.proto; col3.innerHTML = ' ' + msg.u + ' '; col4.innerHTML = ' ' + msg.p + ' ';
The equivalent code is really not that hard:
const span = document.createElement('span')
span.setAttribute('class', 'fi fi'+msg.cc)
span.setAttribute('title', msg.cc)
col1.appendChild(span)
col1.appendChild(document.createTextNode(msg.src))
col2.textContent = msg.proto
let code = document.createElement('code')
code.textContent = msg.u
col3.appendChild(code)
code = code.cloneNode(true)
code.textContent = msg.p
col4.appendChild(code)