71–80 of 110 posts
Earlier quoted context omitted.
Please name the cloud providers that have a policy of allowing malicious actors to do SSH scans? Do you mean Cloudflare?
Let me know if you get banned for doing nmap -p 22 on AWS or GCP.
> When unauthorized port scanning is detected by AWS, it is stopped and blocked.
Page 13
https://web.archive.org/web/20160331233541/https://d0.awssta...
It's not clear, now.
This is not unique to Cloudflare, Level3 or any of the other networks I've seen mentioned in this thread. The entire internet scans all the common ports and this should be expected to continue indefinitely. If this is causing alerts from your logging, there are a few options: - Implement a firewall on your instances. - Implement port knocking for sshd. - Move sshd to a non standard port to avoid the nmap/bot noise. -…
Earlier quoted context omitted.
What kind of answer would you expect, in all seriousness? The thing you are reporting is not illegal or even dodgy.
VPS and VPN providers should be very mindful of their reputation in this regard. If they get a reputation as a "black hole" where complaints vanish and nothing ever happens, the effect may be that other customers start to find themselves blocked or throttled on a subnet level.
This is not unique to Cloudflare, Level3 or any of the other networks I've seen mentioned in this thread. The entire internet scans all the common ports and this should be expected to continue indefinitely. If this is causing alerts from your logging, there are a few options: - Implement a firewall on your instances. - Implement port knocking for sshd. - Move sshd to a non standard port to avoid the nmap/bot noise. -…
This is not unique to Cloudflare, Level3 or any of the other networks I've seen mentioned in this thread. The entire internet scans all the common ports and this should be expected to continue indefinitely. If this is causing alerts from your logging, there are a few options: - Implement a firewall on your instances. - Implement port knocking for sshd. - Move sshd to a non standard port to avoid the nmap/bot noise. -…
I created gofwd, a cross-platform TCP port forwarder with Duo 2FA and Geographic IP integration. Its use case is to help protect services when using a VPN is not possible. While it's use cases are limited, it works great for me when I need to connect to my home network.
The overall elegance of this solution is that no additional software is needed. As long as you are within your predefined geo-ip location, have your phone, and know your hostname/ip address (and port number), then you will be able to access your system remotely.
Is SSH scanning considered "abuse" now?
Port scanning was always considered abuse until researchers decided they needed additional blog post material. I worked for a “business ISP” in the early 90s and we had no qualms kicking someone off the network for it, although usually the originator of the scan had themselves been compromised… because… as I say it was considered at least a breach of terms of service.
Is SSH scanning considered "abuse" now?
I'd say that port scanning is attack prep. When you port scan me I take an adversarial stance. Certainly volume plays a role in determining whether scanning is abusive or not. There are differences between walking by and noticing a door, knocking on a door, trying a key in a door, trying to defeat the lock. Before you can break the lock you have to notice the door. I haven't met any friendly door knockers on the inte…
Earlier quoted context omitted.
Let me know if you get banned for doing nmap -p 22 on AWS or GCP.
They used to block port scanning, back in 2015: > When unauthorized port scanning is detected by AWS, it is stopped and blocked. Page 13 https://web.archive.org/web/20160331233541/https://d0.awssta... It's not clear, now.
This is not unique to Cloudflare, Level3 or any of the other networks I've seen mentioned in this thread. The entire internet scans all the common ports and this should be expected to continue indefinitely. If this is causing alerts from your logging, there are a few options: - Implement a firewall on your instances. - Implement port knocking for sshd. - Move sshd to a non standard port to avoid the nmap/bot noise. -…
I've been happy with having my firewall count SSH connection attempts, and if you make too many attempts in too short a period of time, it just blacklists that IP for 24 hours.