Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Brute.Fail: Watch brute force attacks fail in real time

brute.fail

Post reply on HN
Print view View original

211–220 of 268 posts

Re: Brute.Fail: Watch brute force attacks fail in real time

#211

Post by avidiax »

kenniskrag wrote: post #35
vsviridov wrote: post #24

For this reason I've put `endlessh` on port 22 and moved actual ssh elsewhere... Also started using Crowdsec recently, but not sure about if it's worth it... fail2ban out of the box works fine for SSH, but for dovecot and postfix it's somehow broken, and the configuration scripts are just too obtuse.

Nice idea. From the docs: Endlessh is an SSH tarpit that very slowly sends an endless, random SSH banner. It keeps SSH clients locked up for hours or even days at a time. The purpose is to put your real SSH server on another port and then let the script kiddies get stuck in this tarpit instead of bothering a real server. Since the tarpit is in the banner before any cryptographic exchange occurs, this program doesn't…

I spent 10 minutes to set this up. I was shocked to see that I got my first taker less than a second after I opened port 22 on my firewall.

https://www.abuseipdb.com/check/178.62.237.183

Unfortunately, it only wasted 30 seconds of that IP's time.

It's not clear what type of tarpit would waste the most of the operator's time. Maybe something like a "byzantine VM", that seems exploitable, takes payloads, passes initial checks, and then starts having "problems". DDOS attacks redirect to the C&C server. Coin miners report false mined coins. Hosted files have corruption, and won't complete transfer, etc. Whatever it is, it needs to somehow seem like the operator has an error in their code :)

Re: Brute.Fail: Watch brute force attacks fail in real time

#212

Post by rerdavies »

sophacles wrote: post #156
wkat4242 wrote: post #137

Earlier quoted context omitted.

It's impossible they will brute force your key if you have a decent length. While I'm sure it is possible for some (mainly government) actors to brute force keys, I'm also sure these do not include the same low-hanging-fruit vandals blasting brute force attacks. And I'm also pretty sure you're not one of the select targets of these highly advanced actors. A vulnerability in sshd is indeed possible and happens once in…

Unless the maintainer of your distro's ssh package accidentally introduces an error that reduces the number of possible keys to, say - 32,767 total possible keys.[1] That's a brute-forcible number of keys that fail2ban would help mitigate. (1: https://research.swtch.com/openssl )

Or the NSA subverts a cryptographic standard in order to produce predictable seeds for cryptographic random-number generators that are used to produce private keys. [1]

(1: https://www.bbc.com/news/technology-24048343 )

Re: Brute.Fail: Watch brute force attacks fail in real time

#213

Post by veave »

blueflow wrote: post #203
boringuser2 wrote: post #140

Earlier quoted context omitted.

Rotate your logs bud. Also, suppressing these logs is the same as rapidly rotating new logs.

Rotating only splits the data up into N files, not make it consume less space for a week of logs.

logrotate compresses logs.

Re: Brute.Fail: Watch brute force attacks fail in real time

#214

Post by bootsmann »

nico wrote: post #64

This is amazing! Are you open sourcing this? Can others stream their logs to your servers and have a crowdsourced list of attackers in real time together with their activity?

Hey we actually built the second part as a product. Its a modern revamp of fail2ban combined with crowdsourcing aspect to deliver an up-to-date blocklist of active threats. You can check it out at https://github.com/crowdsecurity/crowdsec

Re: Brute.Fail: Watch brute force attacks fail in real time

#215

Post by tjoff »

BrandoElFollito wrote: post #72
sneak wrote: post #58

Earlier quoted context omitted.

Disable password authentication and fail2ban becomes completely unnecessary.

This. I really do not understand why people use fail2ban when the threat is somewhere else. It won't stop a ddos but will certainly, at some point, prevent you from logging in.

I really don't understand why people use keys when the threat is somewhere else.

Re: Brute.Fail: Watch brute force attacks fail in real time

#216

Post by Dah00n »

nico wrote: post #129
creeble wrote: post #81

Earlier quoted context omitted.

See abuseipdb.com if you care about this.

Thank you! Wish the ISPs would subscribe to this and blocked traffic from the abusive IPs in their networks Clicked on a random IP on the front page, it said it’s from Palo Alto Networks in Santa Clara, that it was first reported in 2022 and the last report was 5min ago. So that IP has been doing shady stuff for months and it seems their ISP (Palo Alto Networks) doesn’t really care

Palo Alto Networks is doing the scanning themselves. I see them in my logs all the time. Won’t do much good to report an abuser to an abuser. They are a “cybersecurity company” like most malicious companies.

Re: Brute.Fail: Watch brute force attacks fail in real time

#218

Post by BrandoElFollito »

tjoff wrote: post #215
BrandoElFollito wrote: post #72

Earlier quoted context omitted.

This. I really do not understand why people use fail2ban when the threat is somewhere else. It won't stop a ddos but will certainly, at some point, prevent you from logging in.

I really don't understand why people use keys when the threat is somewhere else.

Assuming that your comment is serious, where is the threat in your opinion?
Post reply on HN