Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AS13335 doing SSH scanning

encryp.ch

Post reply on HN
Print view View original

91–100 of 110 posts

Re: AS13335 doing SSH scanning

#91

Post by _moof »

brohee wrote: post #8

What is the issue exactly? Is there any kind of exploitation attempts or is someone fishing for banners to do statistics upon? The second case is research, and legitimate...

Just curious/not furious: is there a convincing argument for why one should enable this particular kind of research at the cost of potentially diminished security? I recognize that this question relies on an assumption that is itself arguable, and that it might vary with context.

(Aside: I really wish English had a better way to distinguish between an earnest question and a rhetorical challenge.)

Re: AS13335 doing SSH scanning

#92

Post by Symbiote »

dapids wrote: post #88
jimsi wrote: post #11

Earlier quoted context omitted.

Probably yes, but hey! Why do Cloudflare Worker would need SSH connection establishment? I do not asking Cloudflare to block 22/tcp entirely, but all this situation is very odd - I am seeing anomaly, reported abuse to them, but no explanation why this is happening. About password authentication I totally agreeing with you, but this is a bit out of scope of this thread. The only purpose of this article is to know the…

I think you need to spend more time looking at logs and network traffic in general, this is standard. I bet your public home IP will be scanned at least a couple times just today.

Judging my my home network, they can probably expect an SSH connection attempt on a home IP about every 5 seconds or so, or 18,000 times a day.

For some reason, this is 6× more than a server I have on an university network.

Re: AS13335 doing SSH scanning

#94

Post by hda111 »

rualca wrote: post #58
twodai wrote: post #43

Earlier quoted context omitted.

My favorite is to implement a tarpit while moving the ssh port.

> My favorite is to implement a tarpit while moving the ssh port. For those who, like me, are unfamiliar with the concept of a SSH tarpit, it's a technique consisting of inserting delays into SSH connection attempts. Old HN discussion on Endlessh: https://news.ycombinator.com/item?id=24491453

Isn’t this easily detectable for any malicious script? Just a small timeout and try the next port.

Re: AS13335 doing SSH scanning

#95

Post by tempodox »

loeg wrote: post #64
nickdothutton wrote: post #38

Just use something like fail2ban to drop these at the packet filter level, either courtesy of your cloud provider or on the host itself. Make sure your sshd config is watertight.

You know, or just don’t use fail2ban: https://research.securitum.com/fail2ban-remote-code-executio... . It’s adding extra attack surface for a cosmetic benefit.

Good catch, thanks!

Remedy: Don't let fail2ban send mail, or at least remove the whois part.

Re: AS13335 doing SSH scanning

#96

Post by TechBro8615 »

zinekeller wrote: post #19

Update: they apparently also have a paid product called "Cloudflare for Teams", which also uses the same infrastructure and are targeted for companies. Probably the reason they don't block out SSH is that companies do want SSH access - but I'm pretty sure that RDP access would be higher on the list. My friend working in an ISP has cleared the mystery for me - it's Cloudflare's Warp product (a semi-VPN (in the "telepo…

FYI the WARP VPN is _not anonymizing_ and doesn’t claim to be. If you connect through WARP to a website behind Cloudflare, they will include your real IP in a header.

The main point of WARP is to circumvent ISP traffic shaping (which works quite well btw).

Re: AS13335 doing SSH scanning

#97

Post by TechBro8615 »

marginalia_nu wrote: post #55
brohee wrote: post #9

Earlier quoted context omitted.

What kind of answer would you expect, in all seriousness? The thing you are reporting is not illegal or even dodgy.

VPS and VPN providers should be very mindful of their reputation in this regard. If they get a reputation as a "black hole" where complaints vanish and nothing ever happens, the effect may be that other customers start to find themselves blocked or throttled on a subnet level.

I don’t think anyone is about to block or throttle traffic from Cloudflare IP ranges.

Re: AS13335 doing SSH scanning

#98

Post by TechBro8615 »

eli wrote: post #74
marginalia_nu wrote: post #55

Earlier quoted context omitted.

VPS and VPN providers should be very mindful of their reputation in this regard. If they get a reputation as a "black hole" where complaints vanish and nothing ever happens, the effect may be that other customers start to find themselves blocked or throttled on a subnet level.

I don’t know of any provider that would take action on reports of ssh scanning.

A little bird told me a story that AWS will forward abuse reports to customers performing outbound nmap scans.

Re: AS13335 doing SSH scanning

#99

Post by marginalia_nu »

TechBro8615 wrote: post #97
marginalia_nu wrote: post #55

Earlier quoted context omitted.

VPS and VPN providers should be very mindful of their reputation in this regard. If they get a reputation as a "black hole" where complaints vanish and nothing ever happens, the effect may be that other customers start to find themselves blocked or throttled on a subnet level.

I don’t think anyone is about to block or throttle traffic from Cloudflare IP ranges.

Incoming connections? Why not. I have at times, it's pretty great.

Re: AS13335 doing SSH scanning

#100

Post by alias_neo »

_moof wrote: post #87
t0mas88 wrote: post #83

Earlier quoted context omitted.

I do the same, but only 10 minutes after 5 failed logins. That's enough for bots while not really getting in your way if it accidentally blocks the hotel you're in. Combined with only allowing key based login, password is disabled.

I've recently added 2FA as well. Super easy to do.

I wrote a blog on how to do it a couple years back if anyone is interested in a "tutorial": https://2byt.es/post/totp/

It's for the Pi as that's the target audience but it should apply generally for OpenSSH.

There's also a sister post about improving your "first factor" for those still using passwords: https://2byt.es/post/totp2/

Post reply on HN