Some of these credentials could be of legitime users who have just mistyped the IP address.
Brute.Fail: Watch brute force attacks fail in real time
91–100 of 268 posts
Re: Brute.Fail: Watch brute force attacks fail in real time
#92Earlier quoted context omitted.
Who still allows password-based login for any SSH account, root or not? Keys, certificates, or Kerberos for all users.
I do. For some reason ssh keys became the group-think security advice to repeat ad nauseam. I often find people have only considered this very shallowly, and their reasoning is just "But OMG, entropy lolz" without actually seriously considering the available entropy and likely attack vectors and failure. Why? The benefits are largely theoretical if you choose sufficiently strong randomly generated passphrases, with s…
> ... need to login to another machine from a new machine that doesn't have the ssh-key.
> gateway/proxy/vpn entry to my network has all my ssh keys on it, and it becomes compromised because of some 0-day, the attacker now basically has access to... multiple entire networks
That's why you use SSH agent forwarding https://docs.github.com/en/authentication/connecting-to-gith..., so you never need to copy the private keys to other computers, and thus they can't be stolen from there.
Re: Brute.Fail: Watch brute force attacks fail in real time
#93Earlier quoted context omitted.
This. I really do not understand why people use fail2ban when the threat is somewhere else. It won't stop a ddos but will certainly, at some point, prevent you from logging in.
It keeps the logs cleaner. If you either don't look at the logs at all, or have fancy log analysis systems, then it does not matter. But if you are in the middle, and just manually look at the logs every once in a while, this would be a great help. If you are logging in via ssh, the chances of being locked out arr low - using password auth is a bad idea, and once you set up ssh keys, the connection will always succee…
> the connection will always succeed.
Not from my experience. If you have too many keys and certain ssh agents like gnome keyring don't pick up the key intelligently and will try a all the keys in some order often resulting in the server giving rejecting you due to too many failures.
Re: Brute.Fail: Watch brute force attacks fail in real time
#94Earlier quoted context omitted.
Nice idea. From the docs: Endlessh is an SSH tarpit that very slowly sends an endless, random SSH banner. It keeps SSH clients locked up for hours or even days at a time. The purpose is to put your real SSH server on another port and then let the script kiddies get stuck in this tarpit instead of bothering a real server. Since the tarpit is in the banner before any cryptographic exchange occurs, this program doesn't…
I'd be cautious about stuff like this - if you annoy the wrong person that could paint a target on your back.
They're impotent little weasels who couldn't hit a target the size of a barn, so the risk is minimal.
Re: Brute.Fail: Watch brute force attacks fail in real time
#95Earlier quoted context omitted.
it bugs me that they're not trying the passwords in lexigraphical order :-D also, who has sshd without `PermitRootPassword=no`? they need to broaden their horizons and try `admin`, `ec2-user`, and `ubuntu` /s
Who still allows password-based login for any SSH account, root or not? Keys, certificates, or Kerberos for all users.
I do on my local network. Nothing that's on the Internet. I think it's still enabled by default on Fedora and Debian.
Re: Brute.Fail: Watch brute force attacks fail in real time
#96Server down
Re: Brute.Fail: Watch brute force attacks fail in real time
#97Earlier quoted context omitted.
That seems like overkill. I just disable password authentication, and use SSH public keys only. It prevents brute force attacks completely.
This, and move the endpoint on an uninteresting port to lower the noise in the logs
I suppose it may do that, but naïvely switching to an alternate port may lull one into a false sense of security: https://utcc.utoronto.ca/~cks/space/blog/sysadmin/SSHAltPort...
Shodan will find and fingerprint you easily enough.
Re: Brute.Fail: Watch brute force attacks fail in real time
#98Some of these credentials could be of legitime users who have just mistyped the IP address.
The odds of that are slim to none.
Re: Brute.Fail: Watch brute force attacks fail in real time
#99Re: Brute.Fail: Watch brute force attacks fail in real time
#100Earlier quoted context omitted.
I do. For some reason ssh keys became the group-think security advice to repeat ad nauseam. I often find people have only considered this very shallowly, and their reasoning is just "But OMG, entropy lolz" without actually seriously considering the available entropy and likely attack vectors and failure. Why? The benefits are largely theoretical if you choose sufficiently strong randomly generated passphrases, with s…
> ... need to login to another machine from a new machine that doesn't have the ssh-key. > gateway/proxy/vpn entry to my network has all my ssh keys on it, and it becomes compromised because of some 0-day, the attacker now basically has access to... multiple entire networks That's why you use SSH agent forwarding https://docs.github.com/en/authentication/connecting-to-gith... , so you never need to copy the private k…
On the other hand, SSH agent forwarding means exposing your SSH agent to the bastion host. If that gets compromised, an attacker may be able to move laterally to other systems your personal computer had SSH keys for.