51–60 of 110 posts
Just use something like fail2ban to drop these at the packet filter level, either courtesy of your cloud provider or on the host itself. Make sure your sshd config is watertight.
Earlier quoted context omitted.
I expect to hear who (and why) generates that kind of traffic from cloudflare owned subnets.
I can understand your frustration with background internet noise, but please note Cloudflare is not known for broadcasting their customers' names to the first abuse report with a pcap of a TCP handshake. There may be more realistic ways to go about protecting people's SSH servers that trying to dox Cloudflare VPN users.
In case Cloudflare monitors the keyword "Cloudflare" in HN comments, I'll mention it here – Cloudflare.
I get that some companies have fans, and I get that some of those fans become fanbois - fans regardless of the truth, with a ridiculous us-versus-them mentality. But I seriously doubt there are enough to explain what we see here on HN.
It'd be nice if Cloudflare weren't such assholes. They refuse to answer questions directly, they intentionally use form responses to be vague and uncommunicative when it suits them, and they clearly don't care about doing the right thing. They COULD be a much better company if they just communicated without being smug assholes.
Even a straightforward answer that isn't what we want to hear, like, "These are our VPN endpoints, and we have no plans to do anything about VPN customers who are attempting to brute force ssh." would still make it easy for us to respect Cloudflare. Instead, they facilitate abuse, ignore abuse complaints, and refuse to communicate, which, at least in my opinion, makes them assholes.
This is probably Cloudflare Workers? I don't think that demanding that every ISP inspect and censor outgoing packets is ever going to work. Every network operator has their own definition of good and bad, and it's probably up to that operator to enforce it themselves. Regarding SSH, you can basically assume that 4.2 billion IPs will concurrently try every password database that exists against your server 24/7. Passwo…
Please name the cloud providers that have a policy of allowing malicious actors to do SSH scans? Do you mean Cloudflare?
Earlier quoted context omitted.
Maybe that's a case, but their abuse team hasn't replied anything in a 2 weeks about that after I gave them all timestamps and both source/destination IP addresses
What kind of answer would you expect, in all seriousness? The thing you are reporting is not illegal or even dodgy.
Earlier quoted context omitted.
My favorite is to implement a tarpit while moving the ssh port.
Does that mean that you automatically block IPs that try to login on port 22 (since they are obviously malicious/port scannners)? If yes, is there any specialized daemon for that or are you using firewall rules? Or are you running a SSH honeypot on port 22?
This is not unique to Cloudflare, Level3 or any of the other networks I've seen mentioned in this thread. The entire internet scans all the common ports and this should be expected to continue indefinitely. If this is causing alerts from your logging, there are a few options: - Implement a firewall on your instances. - Implement port knocking for sshd. - Move sshd to a non standard port to avoid the nmap/bot noise. -…
My favorite is to implement a tarpit while moving the ssh port.
For those who, like me, are unfamiliar with the concept of a SSH tarpit, it's a technique consisting of inserting delays into SSH connection attempts.
Old HN discussion on Endlessh:
Earlier quoted context omitted.
Maybe that's a case, but their abuse team hasn't replied anything in a 2 weeks about that after I gave them all timestamps and both source/destination IP addresses
If your ISP and the server support IPv6, just disable SSH on IPv4. Some of my servers don't even have any IPv4 connectivity and there haven't been any failed SSH logins over IPv6.
Earlier quoted context omitted.
My favorite is to implement a tarpit while moving the ssh port.
Does that mean that you automatically block IPs that try to login on port 22 (since they are obviously malicious/port scannners)? If yes, is there any specialized daemon for that or are you using firewall rules? Or are you running a SSH honeypot on port 22?
I'm guessing that the person you replied to is referring to the same.