Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AS13335 doing SSH scanning

encryp.ch

Post reply on HN
Print view View original

81–90 of 110 posts

Re: AS13335 doing SSH scanning

#81

Post by userbinator »

zinekeller wrote: post #19

Update: they apparently also have a paid product called "Cloudflare for Teams", which also uses the same infrastructure and are targeted for companies. Probably the reason they don't block out SSH is that companies do want SSH access - but I'm pretty sure that RDP access would be higher on the list. My friend working in an ISP has cleared the mystery for me - it's Cloudflare's Warp product (a semi-VPN (in the "telepo…

a semi-VPN (in the "teleport to other countries" sense, not the original definition)

It's weird how the "VPN providers" have taken that acronym and turned it into what is basically another synonym for "proxy".

Re: AS13335 doing SSH scanning

#82

Post by bayindirh »

akira2501 wrote: post #75
LinuxBender wrote: post #33

This is not unique to Cloudflare, Level3 or any of the other networks I've seen mentioned in this thread. The entire internet scans all the common ports and this should be expected to continue indefinitely. If this is causing alerts from your logging, there are a few options: - Implement a firewall on your instances. - Implement port knocking for sshd. - Move sshd to a non standard port to avoid the nmap/bot noise. -…

I've been happy with having my firewall count SSH connection attempts, and if you make too many attempts in too short a period of time, it just blacklists that IP for 24 hours.

The first package I install on public facing servers is fail2ban.

After starting it, everything becomes much calmer. Nice thing is, fail2ban can protect much more than SSH.

Re: AS13335 doing SSH scanning

#83

Post by t0mas88 »

akira2501 wrote: post #75
LinuxBender wrote: post #33

This is not unique to Cloudflare, Level3 or any of the other networks I've seen mentioned in this thread. The entire internet scans all the common ports and this should be expected to continue indefinitely. If this is causing alerts from your logging, there are a few options: - Implement a firewall on your instances. - Implement port knocking for sshd. - Move sshd to a non standard port to avoid the nmap/bot noise. -…

I've been happy with having my firewall count SSH connection attempts, and if you make too many attempts in too short a period of time, it just blacklists that IP for 24 hours.

I do the same, but only 10 minutes after 5 failed logins. That's enough for bots while not really getting in your way if it accidentally blocks the hotel you're in.

Combined with only allowing key based login, password is disabled.

Re: AS13335 doing SSH scanning

#84

Post by dilyevsky »

dleslie wrote: post #71
judge2020 wrote: post #54

Earlier quoted context omitted.

Let me know if you get banned for doing nmap -p 22 on AWS or GCP.

They used to block port scanning, back in 2015: > When unauthorized port scanning is detected by AWS, it is stopped and blocked. Page 13 https://web.archive.org/web/20160331233541/https://d0.awssta... It's not clear, now.

We get obnoxious security cgi scanner from palo alto networks tripping alerts all the time coming from gcp ranges

Re: AS13335 doing SSH scanning

#85

Post by codexon »

LinuxBender wrote: post #33

This is not unique to Cloudflare, Level3 or any of the other networks I've seen mentioned in this thread. The entire internet scans all the common ports and this should be expected to continue indefinitely. If this is causing alerts from your logging, there are a few options: - Implement a firewall on your instances. - Implement port knocking for sshd. - Move sshd to a non standard port to avoid the nmap/bot noise. -…

> - Move sshd to a non standard port to avoid the nmap/bot noise.

There are scanners like shodan that will scan every single port you have now so moving it to a non-standard port doesn't stop all the attackers.

Re: AS13335 doing SSH scanning

#86

Post by jms703 »

codexon wrote: post #85
LinuxBender wrote: post #33

This is not unique to Cloudflare, Level3 or any of the other networks I've seen mentioned in this thread. The entire internet scans all the common ports and this should be expected to continue indefinitely. If this is causing alerts from your logging, there are a few options: - Implement a firewall on your instances. - Implement port knocking for sshd. - Move sshd to a non standard port to avoid the nmap/bot noise. -…

> - Move sshd to a non standard port to avoid the nmap/bot noise. There are scanners like shodan that will scan every single port you have now so moving it to a non-standard port doesn't stop all the attackers.

The parent post didn’t say to do this to stop attackers. They said to do this to reduce alerts in the logs.

Re: AS13335 doing SSH scanning

#87

Post by _moof »

t0mas88 wrote: post #83
akira2501 wrote: post #75

Earlier quoted context omitted.

I've been happy with having my firewall count SSH connection attempts, and if you make too many attempts in too short a period of time, it just blacklists that IP for 24 hours.

I do the same, but only 10 minutes after 5 failed logins. That's enough for bots while not really getting in your way if it accidentally blocks the hotel you're in. Combined with only allowing key based login, password is disabled.

I've recently added 2FA as well. Super easy to do.

Re: AS13335 doing SSH scanning

#88

Post by dapids »

jimsi wrote: post #11
jrockway wrote: post #6

This is probably Cloudflare Workers? I don't think that demanding that every ISP inspect and censor outgoing packets is ever going to work. Every network operator has their own definition of good and bad, and it's probably up to that operator to enforce it themselves. Regarding SSH, you can basically assume that 4.2 billion IPs will concurrently try every password database that exists against your server 24/7. Passwo…

Probably yes, but hey! Why do Cloudflare Worker would need SSH connection establishment? I do not asking Cloudflare to block 22/tcp entirely, but all this situation is very odd - I am seeing anomaly, reported abuse to them, but no explanation why this is happening. About password authentication I totally agreeing with you, but this is a bit out of scope of this thread. The only purpose of this article is to know the…

I think you need to spend more time looking at logs and network traffic in general, this is standard. I bet your public home IP will be scanned at least a couple times just today.

Re: AS13335 doing SSH scanning

#89

Post by LinuxBender »

codexon wrote: post #85
LinuxBender wrote: post #33

This is not unique to Cloudflare, Level3 or any of the other networks I've seen mentioned in this thread. The entire internet scans all the common ports and this should be expected to continue indefinitely. If this is causing alerts from your logging, there are a few options: - Implement a firewall on your instances. - Implement port knocking for sshd. - Move sshd to a non standard port to avoid the nmap/bot noise. -…

> - Move sshd to a non standard port to avoid the nmap/bot noise. There are scanners like shodan that will scan every single port you have now so moving it to a non-standard port doesn't stop all the attackers.

Shodan scans a handful of common ports [1] but you are right, a targeted attack will not be stopped by moving ports. Along the lines of what jms703 mentioned, moving ports just removes the noise from the bots so you can have better alerting on real attacks and not suffer from alert fatigue.

[1] - https://en.wikipedia.org/wiki/Shodan_(website)

Re: AS13335 doing SSH scanning

#90

Post by airocker »

LinuxBender wrote: post #33

This is not unique to Cloudflare, Level3 or any of the other networks I've seen mentioned in this thread. The entire internet scans all the common ports and this should be expected to continue indefinitely. If this is causing alerts from your logging, there are a few options: - Implement a firewall on your instances. - Implement port knocking for sshd. - Move sshd to a non standard port to avoid the nmap/bot noise. -…

My experience was similar. I opened a public SSH once and there were many unsuccessful login attempts. The way we resolved it was by installing VPN and closing the IP for public access.
Post reply on HN