Brute.Fail: Watch brute force attacks fail in real time • Hacker News Board

Re: Brute.Fail: Watch brute force attacks fail in real time

#171

Post by 0cVlTeIATBs » Sat, Jun 03, 2023, 3:38 AM UTC

wkat4242 wrote: post #141

bandrami wrote: post #101

Earlier quoted context omitted.

20 years ago port-knocking was supposed to solve this issue for good but it seems to have been never really been taken up. I'm not sure why.

Port knocking as it's usually done is easily sniffed. Perhaps using a dynamic TOTP-like time based seed to constantly rotate the ports might help. But it sounds overly complex. It feels very like a "key under the third plant on the right" kinda thing. Not a solid security measure.

Moxie Marlinspike made something to address the simple knock server's problems.

https://archive.is/MZKkb

Re: Brute.Fail: Watch brute force attacks fail in real time

#172

Post by nerdbert » Sat, Jun 03, 2023, 3:44 AM UTC

wkat4242 wrote: post #135

It's not that funny. While there may be millions of useless attempts, it only takes 1 to get through. Of course SSH has a great option in key / certificate auth. So if that's enforced it's not such a big deal. Many other systems don't (at least not until we finally implement Passkeys everywhere).

It's not a real ssh daemon; there's no "through" to get.

Re: Brute.Fail: Watch brute force attacks fail in real time

#173

Post by seized » Sat, Jun 03, 2023, 3:47 AM UTC

boringuser2 wrote: post #51

Thinking about it, fail2ban is almost entirely a placebo given that your password should be basically impossible to brute force anyways if you have the knowledge to implement fail2ban.

Fail2ban can work on more than just sshd.

Re: Brute.Fail: Watch brute force attacks fail in real time

#174

Post by flangola7 » Sat, Jun 03, 2023, 4:03 AM UTC

Gunnerhead wrote: post #127

menotyou wrote: post #45

I put on my firewall a block for incoming traffic for all IPs outside Europe which helped a lot with the quantity of attempts.

Very naive question: can a bad actor just use a VPN to get around this?

Not if you also block VPNs

Re: Brute.Fail: Watch brute force attacks fail in real time

#175

Post by bandrami » Sat, Jun 03, 2023, 4:03 AM UTC

corn13read2 wrote: post #131

bandrami wrote: post #101

Earlier quoted context omitted.

20 years ago port-knocking was supposed to solve this issue for good but it seems to have been never really been taken up. I'm not sure why.

This is really only effective for password based logins, but most logins these days are key based

No, it cuts the DOS resource usage by a factor of 4 because a TCP connection is never opened.

Re: Brute.Fail: Watch brute force attacks fail in real time

#176

Post by 0___0 » Sat, Jun 03, 2023, 4:11 AM UTC

m00dy wrote: post #34

Realtime honeypot

http://www.m-d.net/projects.php

Re: Brute.Fail: Watch brute force attacks fail in real time

#177

Post by ravi-delia » Sat, Jun 03, 2023, 4:13 AM UTC

sltkr wrote: post #62

vsviridov wrote: post #24

For this reason I've put `endlessh` on port 22 and moved actual ssh elsewhere... Also started using Crowdsec recently, but not sure about if it's worth it... fail2ban out of the box works fine for SSH, but for dovecot and postfix it's somehow broken, and the configuration scripts are just too obtuse.

That seems like overkill. I just disable password authentication, and use SSH public keys only. It prevents brute force attacks completely.

It's not for security, it's public service and entertainment

Re: Brute.Fail: Watch brute force attacks fail in real time

#178

Post by Timber-6539 » Sat, Jun 03, 2023, 4:24 AM UTC

I don't use password authentication and enforce fail2ban on all of my publicly accessible ssh servers.

Even if someone was to steal my keys or knock at my ssh servers with a zero-day, I will be alerted[0] of any successful login(s).

[0] https://github.com/64mb/SLAT-ssh-login-alert-telegram

Re: Brute.Fail: Watch brute force attacks fail in real time

#179

Post by pabs3 » Sat, Jun 03, 2023, 4:24 AM UTC

It is probably time for OpenSSH to deprecate and remove support for password based authentication.

Re: Brute.Fail: Watch brute force attacks fail in real time

#180

Post by chrismorgan » Sat, Jun 03, 2023, 5:07 AM UTC

dlgltlzed wrote: post #134

chrismorgan wrote: post #50

A remark on your fail.js, since you’re engaging here and I figure this could interest you or others: Once there are more than thirty rows, you fade rows in like this: row.style.opacity = 0; let intervalId = setInterval(function() { opacity = Number(window.getComputedStyle(row).getPropertyValue("opacity")); if (opacity This would be better done with a CSS animation or transition—it takes less code, and is smoother. My…

Talking about animations, the little animation next to "Connected to WebSocket" is an SVG. I did not know until today that SVGs may be animated. Nice to know.

That’s SMIL. You can also use CSS animations on SVG these days.