5 ms·

Is this on a well-known cloud hosting provider? I assume so, unless "s3" indicates something else. There have been attacks against known cloud hosting IP rang

Is this on a well-known cloud hosting provider? I assume so, unless "s3" indicates something else. There have been attacks against known cloud hosting IP ranges for a long time. I'm constantly getting attempts on my personal server on common ports (i.e. 3128 for a proxy to spam through), that's on DigitalOcean.

Animats 11y ago
No, it's just the third server of a set, a leased dedicated bare metal CentOS server in a large data center in Phoenix AZ. No "cloud" service is involved. This has been going on for about three weeks now. I may configure PAM to force a login delay; the logs are getting big.
- voltagex_ 11y ago
  Would you consider fail2ban in this case?
  - msl09 11y ago
    "Warning: Using an IP blacklist will stop trivial attacks but it relies on an additional daemon and successful logging (the partition containing /var can become full, especially if an attacker is pounding on the server). Additionally, if the attacker knows your IP address, they can send packets with a spoofed source header and get you locked out of the server. SSH keys provide an elegant solution to the problem of brute forcing without these problems." source: https://wiki.archlinux.org/index.php/Fail2ban https://wiki.archlinux.org/index.php/Fail2ban
    - justinsaccount 11y ago
      > Additionally, if the attacker knows your IP address, they can send packets with a spoofed source header and get you locked out of the server. No they can't. That is not how TCP works.
      - voltagex_ 11y ago
        From memory, you can spoof UDP but not TCP. https://serverfault.com/a/153619/91708 https://serverfault.com/a/153619/91708
- keeperofdakeys 11y ago
  While it doesn't give any real security, changing the ssh port will at least filter out these kinds of attacks.