4 ms·
Here's a simple example: Running sshd on port 22, seeing repeated authentication failures in the logs. conclusion: business as usual for sitting on the interne
by justinsaccount 10y ago
Here's a simple example:
Running sshd on port 22, seeing repeated authentication failures in the logs. conclusion: business as usual for sitting on the internet. signal to noise ratio: almost 0.
Running sshd on port $RANDOM, seeing ANY authentication failures in the logs. conclusion: someone is specifically targeting me or my network, I might want to pay some attention to this. signal to noise ratio: 1.
- zeveb 10y agoRunning on a random port isn't the same as using port knocking; if you're on a random port you'll get hit anyway (I think it falls under 'business as usual for sitting on the Internet'). Port knocking & single-packet authorisation, though, do provide some protection: if you get a failed login attempt via PK/SPA-protected SSH, then you know you're targeted (and also, your PK/SPA key is bad).
- justinsaccount 10y ago> if you're on a random port you'll get hit anyway No, you really won't.
- AstralStorm 10y agoYou might. Some attackers scan all ports.
- ryanlol 10y agoNot for the whole internet, no.
- AstralStorm 10y agoThey actually do, just somewhat later than targeted ones. No need to scan whole of internet either, just subnets you haven't violated already. Or use DNS for major targets.
- ryanlol 10y agoI've allegedly been involved in operating some of the largest *nix botnets ever, and certainly haven't seen anyone do that. Scanning every single port on /0 simply takes way too much time even with millions of nodes, you're much better off improving your coverage over the common ports and catching new (and old) equipment coming online. Of course, this wouldn't necessarily be true with the "preauth opensshd 0day" brought up in TFA. Such an exploit would certainly give you more than enough BW to do whatever you want, and break the internet while doing it.
- haikuginger 10y ago> if you're on a random port you'll get hit anyway Nope. At least, not frequently enough to make a lucky guess more likely than a concerted attempt. Not one auth attempt since I switched the SSH port, and this is for a public-facing website, too.
- ryanlol 10y agoYou know, there's way less hacky solutions to this problem than SSH logs. Set up iptables to log scan attempts specifically targeting your server.