Is SSH scanning considered "abuse" now?
AS13335 doing SSH scanning
31–40 of 110 posts
Re: AS13335 doing SSH scanning
#32Earlier quoted context omitted.
It could also be used for IP reputation, running ssh can be a sign of a proxy or other server/service that website owners might want to block.
I think single SYN packet would be enough to know whether this port open or not, but they trying to gather full banner.
Who cares? Get a better hobby.
Re: AS13335 doing SSH scanning
#33This is not unique to Cloudflare, Level3 or any of the other networks I've seen mentioned in this thread. The entire internet scans all the common ports and this should be expected to continue indefinitely. If this is causing alerts from your logging, there are a few options:
- Implement a firewall on your instances.
- Implement port knocking for sshd.
- Move sshd to a non standard port to avoid the nmap/bot noise.
- Only log successful logins.
- Any combination of the above.
There are pros and cons to each item so you would have to decide which combination is the most appropriate and least friction for your organization. If leaving the port exposed consider enforcing key based authentication and disabling password authentication. For high risk accounts such as monitoring accounts that use passwordless unrestricted sudo, you can even restrict what networks the keys are valid from.
Re: AS13335 doing SSH scanning
#34This is probably Cloudflare Workers? I don't think that demanding that every ISP inspect and censor outgoing packets is ever going to work. Every network operator has their own definition of good and bad, and it's probably up to that operator to enforce it themselves. Regarding SSH, you can basically assume that 4.2 billion IPs will concurrently try every password database that exists against your server 24/7. Passwo…
Please name the cloud providers that have a policy of allowing malicious actors to do SSH scans? Do you mean Cloudflare?
Re: AS13335 doing SSH scanning
#35Earlier quoted context omitted.
Who's trying to dox those users?
I assumed OP wants to know the identity of the Cloudflare users scanning their SSH ports. I think OP guessed it was probably not Cloudflare themselves scanning their ports, so I think that's what they meant by "hear who and why". Maybe dox is too strong a word. My point is, from what I've heard, the general sentiment is that you're unlikely to get any information about customers just by sending abuse reports to Cloud…
OP obviously simply expected at least an explanation on the cause of these ssh connection probes. He got the explanation here (VPN).
Re: AS13335 doing SSH scanning
#36[deleted]
Re: AS13335 doing SSH scanning
#37[deleted]
Re: AS13335 doing SSH scanning
#38Just use something like fail2ban to drop these at the packet filter level, either courtesy of your cloud provider or on the host itself. Make sure your sshd config is watertight.
Re: AS13335 doing SSH scanning
#39Is SSH scanning considered "abuse" now?
Some ssh scanning is obviously abuse. Is it hard to make the difference ?
Re: AS13335 doing SSH scanning
#40Is SSH scanning considered "abuse" now?
Port scanning was always considered abuse until researchers decided they needed additional blog post material. I worked for a “business ISP” in the early 90s and we had no qualms kicking someone off the network for it, although usually the originator of the scan had themselves been compromised… because… as I say it was considered at least a breach of terms of service.