3 months and 1M SSH attempts later
livesshattack.net
3 months and 1M SSH attempts later
1–10 of 69 posts
Re: 3 months and 1M SSH attempts later
#2If you haven't already, get fail2ban setup on the box to slow down all the attacks. And disable password login and switch to certs instead.
Re: 3 months and 1M SSH attempts later
#3If you haven't already, get fail2ban setup on the box to slow down all the attacks. And disable password login and switch to certs instead.
SSH key based auth does not use certificates.
In the case of key-based-auth only, fail2ban is pointless.
Re: 3 months and 1M SSH attempts later
#4If you haven't already, get fail2ban setup on the box to slow down all the attacks. And disable password login and switch to certs instead.
tdicola: To authenticate myself, I use an ssh key. However, the goal of this project was to log all attacks over ssh. So setting up fail2ban and disabling password login would prohibit this collection of data. I have a massive password in place, so I'm not worried in the least.
Re: 3 months and 1M SSH attempts later
#5Change the SSH port...
Re: 3 months and 1M SSH attempts later
#6Just FYI, I wouldn't log into any systems using credentials you find through this. A lot of people are obviously using credentials stolen from previous dumps, so there might be valid ones in there. Logging into a public facing router using stolen credentials is definitely a crime.
Re: 3 months and 1M SSH attempts later
#7Change the SSH port...
The point was to have a look at what kind of attacks are launched on the general internet, so the point was to be attacked.
Also, changing the port does basically nothing these days, with stuff like Shodan around constantly port-scanning.
Re: 3 months and 1M SSH attempts later
#8Change the SSH port...
Like I mentioned above, changing the SSH port would only lessen the attempts on my box. I am interested in collecting as much data as possible.
Re: 3 months and 1M SSH attempts later
#9Just FYI, I wouldn't log into any systems using credentials you find through this. A lot of people are obviously using credentials stolen from previous dumps, so there might be valid ones in there. Logging into a public facing router using stolen credentials is definitely a crime.
Just like it's a crime trying to ssh into a box that is not yours right? And besides I didn't do anything to the router. I was simply pointing out that you should change your default credentials and hide your router.
... should be a crime to not change the default credentials.
Re: 3 months and 1M SSH attempts later
#10Just for fun I ran an SSH server on a RasPi to basically allow any login and to simulate a Linux shell. And then captured the various things that people tried. If you're wondering what the "standard set" of script kiddy tricks are, I highly recommend it.