Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AS13335 doing SSH scanning

encryp.ch

Post reply on HN
Print view View original

61–70 of 110 posts

Re: AS13335 doing SSH scanning

#61

Post by tyingq »

kentonv wrote: post #47
zinekeller wrote: post #19

Update: they apparently also have a paid product called "Cloudflare for Teams", which also uses the same infrastructure and are targeted for companies. Probably the reason they don't block out SSH is that companies do want SSH access - but I'm pretty sure that RDP access would be higher on the list. My friend working in an ISP has cleared the mystery for me - it's Cloudflare's Warp product (a semi-VPN (in the "telepo…

> Cloudflare has also categorically denied that their Worker product allows SSH connections - it is simply not designed for that, apparently. Hi, I'm the tech lead of Workers, so I'll clarify. At present, Workers can only generate HTTP traffic, because the only API we've given Workers for network communications is `fetch()`, which is HTTP-specific. This similar to how in-browser JavaScript today cannot open arbitrary…

His dump of packets shows an MSS of 1380 versus the more common default 1460, which sounds like it's coming from something with tunneled traffic. MSS 1380 would correspond to a source MTU of 1420, which is a typical default for a GRE tunnel in IPv4sec Tunnel mode. Pretty sure that's what WARP is.

Re: AS13335 doing SSH scanning

#62

Post by rollcat »

LinuxBender wrote: post #33

This is not unique to Cloudflare, Level3 or any of the other networks I've seen mentioned in this thread. The entire internet scans all the common ports and this should be expected to continue indefinitely. If this is causing alerts from your logging, there are a few options: - Implement a firewall on your instances. - Implement port knocking for sshd. - Move sshd to a non standard port to avoid the nmap/bot noise. -…

Personally, I just whitelist SSH access on the firewall (UFW and/or AWS SecGrps). Everyone on the admin team has a static residential address. On the road, we use ZeroTier.

Re: AS13335 doing SSH scanning

#63

Post by annoyingnoob »

gtirloni wrote: post #31

Is SSH scanning considered "abuse" now?

I'd say that port scanning is attack prep. When you port scan me I take an adversarial stance. Certainly volume plays a role in determining whether scanning is abusive or not.

There are differences between walking by and noticing a door, knocking on a door, trying a key in a door, trying to defeat the lock. Before you can break the lock you have to notice the door. I haven't met any friendly door knockers on the internet.

Re: AS13335 doing SSH scanning

#64

Post by loeg »

nickdothutton wrote: post #38

Just use something like fail2ban to drop these at the packet filter level, either courtesy of your cloud provider or on the host itself. Make sure your sshd config is watertight.

You know, or just don’t use fail2ban: https://research.securitum.com/fail2ban-remote-code-executio... . It’s adding extra attack surface for a cosmetic benefit.

Re: AS13335 doing SSH scanning

#65

Post by aaron42net »

jimsi wrote: post #18
benjojo12 wrote: post #16

To the best of my knowledge, the IP blocks in the 8.0.0.0/8 range announced by cloudflare are their VPN exit blocks. I had similar issues with them in the past spewing weird traffic. Didn't really ever reach a conclusion on it, other than just reducing logging for that error condition a scanner was triggering.

How did you discover this? Anyway thanks for additional information

Enabling Warp via the "1.1.1.1" Android app gets me an 8.x.x.x VPN address, at least. This /24 appears to be routed to my city's Cloudflare node, so presumably there's a /24 per city they run this service in.

Running a quick port scan from my phone against one of my machines works, so it doesn't look like they are restricting this too heavily.

And I'm not logged into this app and haven't granted it additional permissions, so I'm not sure they have any idea who I am here.

Re: AS13335 doing SSH scanning

#66

Post by Bluecobra »

brohee wrote: post #8

What is the issue exactly? Is there any kind of exploitation attempts or is someone fishing for banners to do statistics upon? The second case is research, and legitimate...

> What is the issue exactly?

The OP has too much time on their hands. :)

You can play this whack-a-mole game indefinitely. If you have SSH open to the Internet, expect that others will try to connect 24/7.

Re: AS13335 doing SSH scanning

#67

Post by jpgvm »

tyingq wrote: post #61
kentonv wrote: post #47

Earlier quoted context omitted.

> Cloudflare has also categorically denied that their Worker product allows SSH connections - it is simply not designed for that, apparently. Hi, I'm the tech lead of Workers, so I'll clarify. At present, Workers can only generate HTTP traffic, because the only API we've given Workers for network communications is `fetch()`, which is HTTP-specific. This similar to how in-browser JavaScript today cannot open arbitrary…

His dump of packets shows an MSS of 1380 versus the more common default 1460, which sounds like it's coming from something with tunneled traffic. MSS 1380 would correspond to a source MTU of 1420, which is a typical default for a GRE tunnel in IPv4sec Tunnel mode. Pretty sure that's what WARP is.

WARP is Wireguard but yeah, otherwise this is pretty much on point. Traffic is tunneled, likely just a random WARP user abusing Cloudflares free VPN service to do some scanning.

Re: AS13335 doing SSH scanning

#68

Post by megous »

nickdothutton wrote: post #38

Just use something like fail2ban to drop these at the packet filter level, either courtesy of your cloud provider or on the host itself. Make sure your sshd config is watertight.

nftables allows to automatize blocking of IP addresses (even with a automatic timeout) without any userspace involvement.

Pretty nifty feature.

Re: AS13335 doing SSH scanning

#69

Post by sudobash1 »

zinekeller wrote: post #24
jimsi wrote: post #20

Earlier quoted context omitted.

My OpenSSH is located on a non standard port, 22/tcp is going to the endlessh honeypot.

Not to disappoint you, but except for logging SSH honeypots are becoming useless (most bots automatically disconnect when they detect a long login banner).

So should I add a long banner to my server to disguise it as a honey pot, just in case?

Re: AS13335 doing SSH scanning

#70

Post by tyingq »

jpgvm wrote: post #67
tyingq wrote: post #61

Earlier quoted context omitted.

His dump of packets shows an MSS of 1380 versus the more common default 1460, which sounds like it's coming from something with tunneled traffic. MSS 1380 would correspond to a source MTU of 1420, which is a typical default for a GRE tunnel in IPv4sec Tunnel mode. Pretty sure that's what WARP is.

WARP is Wireguard but yeah, otherwise this is pretty much on point. Traffic is tunneled, likely just a random WARP user abusing Cloudflares free VPN service to do some scanning.

Ah, okay. Google searches suggests the default MTU on Wireguard is also 1420, which would produce an MSS of 1380. So that makes sense.
Post reply on HN